01-15 July 2013

Biometrics

NZ – Privacy Issues Raised In Face Recognition for Problem Gamblers

The Department of Internal Affairs says the use of facial recognition technology for problem gamblers at gaming machines raises privacy issues. The technology, developed by the company Positive Outlook, takes photos at the machines and locks them down when an excluded gambler approaches. It is being trialled at a Hamilton pub and may be used at other pubs and clubs around the country. Regulatory services general manager Maarten Quivooy says significant issues need to be worked through before the technology is used more widely, as there are concerns about who manages and has access to the database that stores people’s images. He says there are also questions about the speed and level of accuracy of the camera technology, and the cost. Positive Outlook says the technology does not breach privacy. A company director, Bruce Tevarthen, says as it is an opt-in system, only images of those who have elected to formally enrol are held. He says the images database is administered by an independent party. [Source]

Canada

CA – Canadian Senate Remands Bill C-377

On June 26, Liberal, Conservative and Independent senators joined together in a rare demonstration of non-partisan co-operation to amend Bill C-377, a private member’s bill that would have forced labour unions to publicly disclose an unprecedented amount of personal information relating to individual Canadians and businesses, and post them, with names, on the Internet. The Privacy Commissioner of Canada testified that this would be a “significant invasion of privacy.” We were told repeatedly by constitutional experts that the bill was unconstitutional, that the issues addressed fell within provincial jurisdiction, and that we would be exceeding our constitutional jurisdiction if we passed it. Five provinces told us the bill should not proceed. These were governments of every political stripe — Liberal, NDP, Parti Québécois and Conservative. Together, they represented more than 70 % of the population of Canada. They told us the bill could destabilize labour relations in their provinces; one minister said it would be “a grenade in the room of collective bargaining.” A Senate committee sat for three weeks of hearings studying Bill C-377. They heard from 44 witnesses. The overwhelming weight of the evidence was that the bill was deeply flawed. Many Canadians have written to applaud the actions of the Senate in amending the bill and returning it to the House of Commons for further consideration. They say it demonstrates exactly why the Senate exists, and the importance of sober second thought. [Source] See also

CA – Supreme Court Will Hear Case Dealing With Privacy Rights for Cellphones

The Supreme Court of Canada is taking on the question of whether police can access information on a cellphone that isn’t protected by a password. The court has agreed to hear an appeal from Kevin Fearon, who was arrested after an armed robbery in Toronto in 2009. Police obtained photos of a gun and cash, as well as a text message about jewelry, after taking a closer look at Fearon’s phone, which was unlocked. After he was convicted, Fearon appealed, arguing that police breached his rights when they examined the phone after his arrest. The Ontario Court of Appeal said it was all right for the police to look through the phone in a cursory fashion to see if there was evidence relevant to the crime, but after that they should have stopped to get a search warrant. Had the phone been password-protected or otherwise locked to anyone other than its owner, “it would not have been appropriate” to look through the phone without a search warrant. The appeal judges referred to a decision in a murder case in which the judge did not allow evidence from a personal electronic device because it “functioned as a mini-computer,” which has a high expectation of privacy. The contents of that device were only extracted by a police officer using specialized equipment, the judges noted. “There was no suggestion in this case that this particular cellphone functioned as a ‘mini-computer,’ nor that its contents were not ‘immediately visible to the eye,’” the court said in its ruling. “Rather, because the phone was not password-protected, the photos and the text message were readily available to other users.” Defence lawyer Sean Robichaud said that approach failed to take into account the amount of information many people keep on their cellphones these days. Fearon also appealed over the issue of access to a lawyer, saying he was left in an interview room for five hours without an opportunity to contact counsel. The Supreme Court, however, said the appeal will be limited to the cellphone issue. [Source]

WW – International Privacy Coalition Call on the EU to Increase Data Protection

In response to revelations regarding PRISM and related surveillance programs, privacy advocates from the U.S., Canada and Europe have issued a consensus statement calling on the EU to increase data protections. The EU’s data protection framework has been a model of privacy protection for many countries in the world, including Canada. The EU framework gives citizens vastly more privacy protections than citizens have in the US. The EU is currently reforming its data protection framework and the US is lobbying heavily to see EU privacy protections eroded. Gathered in Washington, DC for the conference on Computers, Freedom and Privacy (CFP), a dozen groups from both sides of the Atlantic joined the “Washington Statement,” including the American Civil Liberties Union (ACLU), the Electronic Privacy Information Center (EPIC), European Digital Rights (EDRi), Privacy International, and the British Columbia Civil Liberties Association (BCCLA). The group warned policymakers that “Our common future, on both sides of the Atlantic, needs privacy and a strong European law. We call on European policy makers to defend this human right now, as an essential prerequisite for preserving privacy, freedom of thought and of expression in vibrant democracies.” [Source]

CA – Businesses Push for Freedom to Share Personal Data Across Borders

If business groups in Canada and the United States get their way, new free-trade rules would limit the ability of governments to block cross-border flows of personal and financial data. The Canadian Chamber of Commerce, which speaks for 200,000 businesses across the country, is joining the U.S. Chamber of Commerce to push for new data standards in future free-trade deals, starting with the 12-country Trans-Pacific Partnership. The lobbying push is part of an
effort by the business community to stamp out what it sees as rising “digital protectionism” – everything from Internet censorship to privacy laws mandating the storage of certain personal data within countries. “What we’re seeing increasingly is that governments are trying to impose controls on the flow of data in a variety of ways,” said Perrin Beatty, the Canadian chamber’s president and chief executive officer. [Source]

CA – Media Trampled on Terror Suspects’ Rights: Civil Liberties Group

The mob of reporters and photographers that swept through the suite of a Surrey, B.C., couple charged in the alleged Canada Day terror plot had no legal right to snoop through their home, according to the BC Civil Liberties Association (BCCLA). Two days after Mounties arrested Amanda Korody and John Nuttall, their landlord allowed media members to walk freely through the basement suite. A QMI Agency staffer who went into the house twice witnessed a reporter rifling through a notebook belonging to the couple and videotaping pages. He also noticed things were moved after his initial visit — drawers and closets were opened and artifacts appeared rearranged and grouped. The QMI Agency legal team advised the newsroom to refrain from publishing photos from inside the house. BCCLA executive director Josh Paterson said no one should have been in the house in the first place, as there’s only a handful of specific reasons a landlord can legally enter a suite. “They can do it if there’s an emergency, they can do it if they have to show the unit, or if the tenant had abandoned the unit, but there’s no information here to suggest any of those things are true,” he said. “Just because you got arrested and maybe put in jail, doesn’t end your residential tenancy. That’s a whole separate process. [Source]

CA – Canadian Retailers Using Postal Code Information to Target Customers

In line at the cash at the LCBO, Ikea or Walmart, the cashier takes your card and asks for your postal code. Why is she asking? What should you do? Retailers, including the LCBO and Ikea, say postal code information is collected to fine-tune services for customers, including product selection, and to target flyers to specific neighbourhoods to reduce waste and save money on postal services. But the potential exists for using postal code information to compile personalized mailing lists that can be sold or shared. Data collection and management companies including Harte-Hanks Data Services and Solutions, which operates worldwide, offer businesses the ability to use software to match postal codes with credit card information to come up with unique addresses. “Users simply capture names from the credit card swipe and request a customer’s ZIP code during the transaction. GeoCapture matches the collected information to a comprehensive database to return an address,” according to information posted to the firm’s website. “Works at the point of sale to identify customers, understand purchase behaviour and follow up with dynamic, personalized marketing.” Canadians are more worried than ever about the misuse of their personal information, according to the results of a survey released late last year by the Office of the Privacy Commissioner of Canada. “Seven in 10 think that their personal information has less protection in their daily lives than it did 10 years ago, an increase of 10% since 2011. As well, the majority (56%) are not confident that they have enough information to know how new technologies affect their personal privacy which is the highest expression of a lack of confidence for this question since tracking began in 2000,” the survey found. It also found that Canadians are reluctant to share their personal information with organizations (57% never or rarely do so), and most (60%) have asked for an explanation of how an organization will use their information. No one is obliged to divulge their postal code at point of purchase, says Scott Hutchinson, a spokesman for Canada’s privacy commission office. “People who may wish to entertain the request should be encouraged to ask why the information is needed and what it will be used for; and if they don’t like the answer, they can be equally encouraged to simply just say ‘no,’ ” he says in an email to the Star. [Source]

CA – Ontario Privacy Commissioner Receives Anti-Bully & Online Safety Award

Ontario’s Information and Privacy Commissioner Ann Cavoukian is the latest recipient of the  KnowledgeFlow CyberSafety Champion award for her relentless drive to raise awareness in support of the most important causes affecting youth and families in the information age. “Dr. Cavoukian consistently raises the bar across a number of important domains. Her efforts to curb the victimization of the most vulnerable members of our society is something that we are proud to recognize” said Claudiu Popa, CEO of Informatica Corporation and founder of the KnowledgeFlow.ca Initiative. [Source]

Consumer

US – Americans Divided on Snowden; Young Alito Pushed for Protections

The New York Times reports on a poll indicating division among Americans on whether Edward Snowden is a traitor or a whistleblower. The Quinnipiac University poll indicates the majority of those surveyed—55% —said he was a whistleblower for revealing the National Security Agency’s (NSA) PRISM program, while 34% said he was a traitor. Meanwhile, a report cited in the Electronic Privacy Information Center’s lawsuit asking the Supreme Court to halt the NSA’s surveillance program indicates that Supreme Court Associate Justice Samuel Alito, in his days as a Princeton undergraduate, urged strict safeguards to protect personal privacy online. [Source] [US: Poll Shows Complexity of Debate on Trade-Offs in Government Spying Programs] See also: [Post Mortem, What Happens to Your Account Info?]

US – Complaint Filed Over Jay-Z/Samsung App

The Electronic Privacy Information Center (EPIC) has filed a complaint on Jay-Z and Samsung’s Magna Carta Holy Grail app. “Samsung failed to disclose material information about the privacy practice of the App, collected data unnecessary to the functioning of the Magna Carta app, deprived users of meaningful choice regarding the collection of their data, interfered with device functionality and failed to implement reasonable data minimization procedures,” EPIC said in its complaint, filed July 12. [Arts Technica]

E-Government

AU – Govt Releases Security and Privacy Requirements for Cloud

The federal government has set out provisions for government agencies using cloud without compromising security or privacy. Attorney-General Mark Dreyfus said the policy will help government agencies make decisions around whether to offshore or outsource processes and requires agencies to seek government approval before storing personal information in the cloud. The policy follows the May release of the and the Australian Government Cloud Computing Policy v2.0. Dreyfus said several privacy safeguards have been built into the policy, which has been called the Australian government policy and risk management guidelines for the storage and processing of Australian government information in outsourced or offshore ICT arrangements. Under the policy, approval will be required by both the minister responsible for the information and the Attorney-General before personal information can be stored in the cloud. [Source] See also: [How to address the risks of 24/7 government] and [How Ontario faces big data privacy challenges]

JP – Japan Govt Used Wrong Privacy Settings in Google Groups

Japanese government officials and journalists have mistakenly revealed internal memos, draft stories and interview transcripts by reportedly using the incorrect privacy settings in Google Groups. Yomiuri Shimbun, a Japanese newspaper, reports it found more than 6,000 cases where public or private organizations revealed nonpublic information, including hospital records, via the wrong privacy settings. [ZDNet]

E-Mail

US – Google Glass Privacy Concerns Persist in Congress

U.S. Rep. Joe Barton of Texas says he is “disappointed” in Google’s response to privacy worries caused by the emergence of Google Glass. In a statement released after the Republican congressman reviewed Google’s response to a letter sent to the company by members of the Congressional Bi-Partisan Privacy Caucus — a group set up to examine the privacy issues Google Glass causes — Barton said he believes that the general public needs to be given more choice to ensure their privacy is not violated. In May, congressional leaders wrote to the tech giant to establish what controls will be put in place to protect consumer privacy. Addressed to Google CEO Larry Page, the letter (PDF) questions whether Google Glass will “infringe on the privacy of the average American,” and asks what place facial recognition technology will hold in relation to the headset’s ability to record video and take photographs. Google, in response to the letter, says that “protecting the security and privacy of our users is one of our top priorities,” and one way of doing so is making sure Google Glass requires voice activation to take video footage or shoot images. In addition, Google says that such actions activate the product’s screen, which is a change visible to others. To address facial recognition technology worries — where personal information about others or objects could be revealed without consent — the tech giant says that it “will not be approving any facial recognition Glassware at this time,” and will “prohibit developers from disabling or turning off the display when using the camera.” No changes in Google’s privacy policy are planned with the emergence of Google Glass. Finally, Google says that all files stored on the device will be deletable by users. Headsets can be remotely wiped in the case of loss or theft, and the company is currently experimenting with different ways to “lock” Glass flash memory to secure data. [Source]

US – Google Glasses Secretly Film Arrest

Documentary filmmaker Chris Barrett captured an arrest using Google’s wearable computer during a trip to the Jersey Shore boardwalk on July 4, where he witnessed a fight resulting in police intervention. Barrett filmed the incident without being noticed, the report states. “More notable than the video itself is the ease at which it was captured without the knowledge of those in the middle of the melee. His footage foreshadows the rapidly approaching future where everything can be filmed serendipitously by folks wearing devices like Google Glass without the knowledge of the parties involved,” wrote Thompson Reuters’ Christophe Gevrey. [Business Insider]

Encryption

US – Microsoft Provided NSA More Help Than Previously Disclosed

Relying on NSA documents provided by Edward Snowden, The Guardian reported that Microsoft recently worked with the FBI to help the NSA get around encryption on Microsoft services, such as online chats on Outlook.com, and to monitor conversations on the company’s Skype service. The newspaper also said that Microsoft worked recently with the FBI to streamline the way NSA can access users’ files on SkyDrive, Microsoft’s online document storage service, when Microsoft is required to provide that information for foreign-intelligence purposes. Microsoft said it doesn’t provide governments with blank or direct access to Microsoft services. [Wall Street Journal]

IN – Indian Govt Can Now Intercept Consumers’ BlackBerry Communications

BlackBerry has come to an arrangement with the Indian government to allow “lawful interception” of communications in realtime. The system allows the Indian government to track consumers’ communications sent to or from any Blackberry device, regardless of whether the message has been delivered or read. The system does not include corporate email messages sent over BlackBerry Enterprise Server. News of the arrangement has raised questions among analysts about whether the Indian government will now turn its attention to Apple, whose iMessage and Facetime services use end-to-end encryption. [ZDNet] [BBC.co.uk]

EU Developments

EU – European Parliament Demands Information on PRISM

The European Parliament has passed a resolution demanding that the US government provide “full information on PRISM and other such programmes involving data collection.” In addition, the European Parliament Civil Liberties Commission has voted to launch an “in-depth inquiry” into privacy and civil rights issues for EU citizens raised by PRISM. The Parliament is calling on member nations to consider putting a hold on counter-terrorism data transfer agreements with the US until the data are better protected. [ComputerWorld] [WashingtonPost] [Europarl] [[Europarl]

EU – EU Special Committee to Investigate Spying Reports

As headlines continue to abound regarding concern from EU officials and member states, EurActiv reports the European Parliament “plans to establish a special committee to investigate reports that an American spy agency monitored phone calls and e-mails of EU institutions and some member states.” The panel, which will be established as part of the Committee on Civil Liberties, Justice and Home Affairs, will deliver its report by year’s end and “formulate proposals on adequate redress measures in case of confirmed violations and put forward recommendations to prevent that similar espionage events happen in the future,” the report states. Following communication with U.S. Attorney General Eric Holder, Justice Commissioner Viviane Reding said, “The U.S. appears to take our concerns regarding PRISM seriously,” noting Holder has committed to setting up an expert group “to assess the matter in detail…and the group will have its first meeting this month and a second one in Washington in September.” Meanwhile, in a TechNewsWorld interview, Oxford Prof. Viktor Mayer-Schönberger opines, “People feel they have been deceived; people feel that they cannot trust the U.S. government.” [Source]

EU – EU Wants Data Protection Bill by May 2014

EU Justice Commissioner Viviane Reding is calling to accelerate movement on the data protection bill currently stuck in the European Parliament’s civil liberties committee. “I would find it helpful if the European Council in October, which will deal with the European single market, could address this matter and speed up the work in the council on this important file,” said Reding in her appeal on Monday. Meanwhile, Hogan Lovells’ Christopher Wolf opines in Financial Times that “it is wrong to assume the U.S. is the worst regarding surveillance,” arguing that Europe does its fair share. [EUObserver] SEE ALSO: [Breach Requirements Are Coming: Roundup]

EU – Netherlands: The Dutch Cookie Monster

On June 5, 2012 new Dutch legislation on the use of cookies entered into force. This new regime, which introduces a requirement for informed consent based on an opt-in system, has major implications for online advertising companies focusing on Dutch customers. To implement Directive 2009/136/EC [ePrivacy Directive], the law regarding cookies in The Netherlands has now been revised to include a consent that should be given explicitly by the internet-user in cases of “third party” and “tracking cookies”. The same requirement of explicit consent applies should a provider want to place cookies for online behavioural advertising purposes. [Source]

EU – Majority of Retailers Say New Rules Will Harm Business

More than two-thirds of online retailers say proposed changes to EU data protection rules will damage business. That’s according to a recent survey by the European Multi-channel and Online Trade Association, which represents more than 80 percent of EU online traders, the report states. The survey polled 90 companies from the UK, Germany, Austria, France, Sweden, Switzerland, Greece and Spain. [EurActiv]

EU – Sky Deutschland to Broadcast Ads Directly into Train Passengers’ Heads

Sky Deutschland has developed technology to transfer adverts from train windows directly and silently into commuters’ heads. Passengers leaning their head against the window will “hear” adverts “coming from inside the user’s head”, urging them to download the Sky Go app. The proposal involves using bone conduction technology, which is used in hearing aids, headphones and Google’s Glass headset, to pass sound to the inner ear via vibrations through the skull. BBDO spokesman Ulf Brychcy told the BBC: “If our customer Sky Deutschland agrees, we will start with the new medium as quickly as possible. [Source]

EU – Dutch DPA Rules Against Mobile Telcos

The Dutch Data Protection Authority (DPA) has found that four mobile phone operators–KPN, Tele2, T-Mobile and Vodafone–violated Dutch laws regarding user data retention and anonymization. According to the regulator’s study, which began in 2011, the companies failed to delete or anonymize data such as websites visited and apps used as quickly as possible, as regulations require. Of the four, KPN is reportedly the only operator to have resolved each of the issues identified by the investigation. The others claim to be actively addressing the issues in cooperation with Dutch regulators. Meanwhile, Bird & Bird’s Berend van der Eijk has said a bill proposing fines of up to €450,000 for public and private organizations that fail to meet notification requirements “is very likely” to pass, noting the earliest it would enter “into force would likely be 1 July 2014, or more realistically, 1 January 2015.”

CH – Swiss DPA Releases Annual Report

Switzerland’s DPA has issued its 20th Report of Activities, covering the timeframe of April 2012 to March 2013. Hunton & Williams’ Privacy and Information Security Law Blog details the report’s focus on several data protection issues including employer monitoring of employee behavior at work, businesses’ social media and loyalty program analytics and whistleblowing provisions.

EU – Regulators Prepared to Take Action Against Google

The UK Information Commissioner’s Office (ICO) has written to Google to warn the company that it could take “formal enforcement action” if it does not alter its privacy policy by September 20. “In our letter we confirm that its updated privacy policy raises serious questions about its compliance with the UK Data Protection Act,” an ICO spokesperson said. The updated policy “does not provide sufficient information to enable UK users of Google’s services to understand how their data will be used across all of the company’s products.” Meanwhile, Hamburg Commissioner for Data Protection and Freedom of Information Johannes Caspar says his office will join other European regulators, including Spain, in taking action against the company. [Out-Law.com]

EU – DPA Asks Facebook for Clarifications

The Italian Data Protection Authority, the Garante, is requiring Facebook to provide clarifications by July 20 on personal data processing following recent announcements of a “bug” that cause the exposure of personal information. Panetta & Associati Studio Legale’s Rocco Panetta writes, “Facebook has already assured that the unwanted data processing has occurred due to a mere technical bug.” Despite that, he notes, the Garante is requiring confirmation on six points, including the duration of the event and measures taken to resolve the issue. [Privacy Advisor]

EU – Twitter Gives Anti-Semitic Posts to Authorities

Microblogging site Twitter has complied with a French court’s request to hand over tweets related to a number of racist and anti-Semitic messages that were posted on its site. An appeals court ruled last month that the company must hand over the names of the users propagating the anti-Semitic messages, raising the thorny issue of online anonymity and hate speech. Twitter said in a statement that handing over the data will “put an end to the dispute” and that it will work with the Union of Jewish French Students to “fight racism and anti-Semitism.” [CNET News]

Facts & Stats

US – California AG Breach Study Highlights Importance of Encrypting Data

A report from California’s attorney general found that in 2012, 2.5 million California residents had their personal information compromised in the 131 security breaches that were reported to the AG’s office. The report also notes that had companies encrypted their stored data, 1.4 million people would not have had their personal information exposed. Under state law, breaches do not need to be reported if the data affected are encrypted. [SCMagazine] [Press Release] [California’s first data-breach report finds 131 incidents hit  2.5 million citizens] and [NZ: Privacy breaches already at 20]

Filtering

WW – Visa and Mastercard Blocking Payments to Some VPN Providers

Swedish online payment service provider PaySon says that Mastercard and Visa have ordered the company to stop allowing payments to some virtual private network (VPN) providers and anonymization services. The new focus on VPNs and anonymization services appears to be directed at five companies that have been linked to P2P piracy. In a related story, WikiLeaks says that its Icelandic payment processor, Valitor, is once again accepting donations from credit cards for the organization. In 2010, Mastercard and Visa ordered payment processors not to process payments to WikiLeaks. An Icelandic court ruled recently that Valitor must resume processing payments to WikiLeaks. [TechEye] [The Register] [TechDirt] [ArsTechnica] [Reuters]

Finance

WW – Privacy Concerns out of M-Pesa Mobile Banking

The mobile phone-based money transfer system M-Pesa, which has brought mobile banking to the poor in Kenya, can be used to identify unsuspecting users, potentially compromising their privacy. Grace Githaiga, a Nairobi-based ICT expert, said in order to use the system, a user must submit their ID card number and address, which in turn are transferred to an M-Pesa agent. According to Githaiga, it’s not clear where the data ends up. Additionally, a loophole in the system means users can identify other users who might otherwise wish to remain anonymous. She notes that Kenya does have pending data protection legislation, though not an existing law, “but that tells you that there’s debate around data protection, and some of these things are going to be raised in that bill.” [Deutsche Welle]

CA – Privacy Debate Looms as Canada Prepares to Share Bank Data with U.S.

Tightening tax evasion versus protecting personal privacy looms large for Canada as it prepares to announce a deal with the United States to share banking information. The arrangement would allow Ottawa to soften the blow for Canada – and the roughly one million Americans who live here – when it begins complying with the more controversial aspects of a sweeping new U.S. law that takes effect on Jan. 1. The Foreign Account Tax Compliance Act (FATCA) was signed into law in March 2010, and many of its provisions start on Jan. 1, 2014. It requires financial institutions in other countries to tell the U.S. Internal Revenue Service about Americans’ offshore accounts worth more than $50,000. Canada and the U.S. are negotiating whether Ottawa or the financial institutions will send the information, but the clock is ticking. If no deal is reached, banks operating in Canada will have to give the data directly to the IRS. Canada and the U.S. already share financial information to track activity like money laundering and terrorist financing, but the U.S. tax act creates a need to sort out exactly what will be shared and how.  Canadian banks have urged Ottawa to take on the reporting duties through the Canada Revenue Agency, which could ensure that privacy laws are respected when information is sent south of the border. Over the past year, the U.S. has signed bilateral deals to enforce the act with Germany, Japan, Spain, Norway, Switzerland, Ireland, Mexico, Denmark and the United Kingdom. The FATCA has created considerable concern for Americans in Canada, given that many have long ignored a U.S. rule requiring citizens to file annual tax returns even if they are not earning income in the United States. The leaders of the G8 recently pledged support for the automatic transfer of financial information to crack down on global tax evasion. “The privacy implications of FATCA in Canada will depend on the details, which have yet to be determined,” said the federal Privacy Commissioner’s office. “Many of the people who have contacted us have expressed concern about their personal information being shared with U.S. authorities.” That concern is warranted, said Queen’s law professor Arthur Cockfield, who specializes in tax law. “No foreign government should be able to come into our country and demand personal information about our own citizens and residents,” he said, noting that the negotiations are aimed at smoothing over this problem by ensuring exchanges are mutual and at the government-to-government level.  “There’s really been a conceptual shift around FATCA in the last, say, three or four months,” he said. “It was mainly hated by Canada and at least some European governments.” Mr. Cockfield said stories on tax evasion by the International Consortium of Investigative Journalists, which began in April and for which he provided commentary, have clearly changed the international political scene as European leaders began promising automatic exchanges like FATCA. [Source]

FOI

US – US Justice Department Revises Policies on News Media Data Seizure

Revised guidelines from the US Department of Justice limit the government’s access to journalists’ records except in cases in which the journalist is the subject of a criminal investigation. Ideally, journalists are protected by the First Amendment regarding freedom of the press and the Fourth Amendment regarding unreasonable search and seizure, as well as the privacy Protection Act and other laws. The need for a revised and clarified policy became evident when the government launched an inquiry that characterized a journalist as a spy, criminalizing his efforts to obtain information from a source; and when the government obtained phone records for AP journalists. [Information Week] [Justice.gov]

US – NY Court Takes Up Teacher Pension Privacy Issue

New York’s highest court will soon decide whether the names and benefits of retired teachers in public pension plans should be made public. The Empire Center, a project of the fiscally conservative Manhattan Institute think tank, was denied the names by the state and city teachers’ retirement systems under the state Freedom of Information Law. In refusing to release the information, the teacher pension systems cited a recent court decision that protects police retiree names. Lower courts agreed with that privacy argument, and the Empire Center appealed to the Court of Appeals, which accepted the case last week. The Empire Center collects such data for its own research, for news media and for private individuals to track how public money is spent and to help identify any abuses. The center doesn’t seek addresses or other data from the records, which were once provided by the retirement systems as public documents. Arguments are expected within weeks; a decision could come weeks later. Empire Center Director Timothy Hoefer said the Court of Appeals decision to take the case is seen as a “ray of hope for public transparency.” [Source]

Genetics

WW – Little Debate on Privacy as DNA Collection Flourishes

The collection of DNA by governments around the world is flourishing but there is a lack of public debate about the privacy and ethical issues raised by such collection. Yaniv Erlich of MIT’s Whitehead Institute for Biomedical Research said there is a lot of upside to having DNA databases, but said, “our work shows there are privacy limitations.” Others have warned of “mission creep” where law enforcement use DNA to gather data on racial origins, medical history and psychological profiles. A University of Baltimore forensics professor said, “There’s got to be a debate… Do we want to have a society where 5% of the crime is unsolved, or do we want to have a society where 100 percent of the crime is solved” but privacy goes extinct? “What’s the trade-off?” [The Associated Press] [Spread of DNA databases sparks ethical concerns]

WW – Privacy and the Family Genetic Inheritance

In this audio episode of Family Caregivers Unite, Dr Gordon Atherley interviews Ma’n Zawati, LLB, LLM, a lawyer and Academic Coordinator of the Centre of Genomics and Policy at McGill University. He shares his personal story, describes his research and work as a lawyer, and explains the Centre’s research regarding family genetic information. He discusses protections provided by privacy and security laws against theft and disclosures of our genetic information that could be harmful to us. He suggests ways in which the principles underpinning laws could be improved so our genetic information and that of our families can be better protected. He says what more he wants to do and see done by governments to improve laws to protect against abuse of our and our families’ genetic information. He says what more help is needed by individuals and their families so they can understand and speak about their fears of the risks of abuse of their genetic information. He shares his message for family caregivers. [Source]

US – Court Ruling On DNA Swabs Worries Local Privacy Advocates

A major decision handed down by the Supreme Court puts the right to privacy up for debate. The court ruled it is ok to take a DNA mouth swab from a person simply while under arrest to see if they could be connected to unsolved crimes. Law professor and defense attorney Richard Kling calls it a “dangerous precedent” but admits a mouth swab is just like a fingerprint. “With no probable cause and with no warrant and no consent, you can now be forced to give a DNA swab which can be used to investigate you for anything and everything — regardless of whether you’re under suspicion,” said Kling. “It creates this massive database nationally of DNA,” said Ed Yohnka of the ACLU. “It opens up all kinds of opportunities for discrimination, denials for other kinds of mistreatment that frankly we shouldn’t do because government shouldn’t have the information in the first place,” said Yohnka. [Source]

Health / Medical

US – Workers Fired Over Kardashian Breach

Five healthcare workers from Cedars-Sinai Medical Center—a common destination for celebrities seeking medical treatment—have been fired for unauthorized access to 14 patient records, including those of Kim Kardashian. Representatives from the organization said they have a “high standard for security” and “in this case that standard was violated.” In other breach news, the personal records of as many as 277,000 former patients of a North Texas hospital were found in a Dallas park and included contact details and SSNs. And Long Beach Memorial Medical Center has notified 2,864 patients their medical records have been compromised. Reports state the breach stems from an internal employee but no further details have been issued thus far. [Reuters] See also: [NZ: Ryder’s privacy breached during hospital stay – investigation] and [Florida Department of Health sweeps confidential Rx data leak under rug] and [US:  Fort Worth Hospital Notifies Patients from 1980 to 1990 of Potential Records Privacy Issue]

US – Health Sites Under Scrutiny Over Mining of Data

Illinois Attorney General Lisa Madigan’s recent inquiry into the data-mining practices of popular health websites such as WebMD and Health.com. Madigan has sent letters to the sites’ executives citing concerns about the dissemination of data related to web surfers’ health-related searches, the report states. “Health-related information, which would be protected from disclosure when said in a doctor’s office, can be captured, shared and sold when entered into a Web site,” Madigan wrote, adding that consumers likely overlook such concerns if information on disclosures is buried in privacy policies. One researcher recently found third-party entities often track patients searching health-related terms. [The New York Times] See also: [Privacy, security concerns of enabling patient access to PHI]

US – Digital Diapers Track Children’s Health

Newly developed baby diapers complete with digital tracking technology can detect potential urinary tract infections, kidney dysfunctions and dehydration. Developed by Pixie Scientific, the diaper connects to a smartphone app and can transmit the health data to a central database where a physician can interpret the information. The technology is currently being tested by a number of children’s hospitals and, if successful, would then be submitted to the U.S. Food and Drug Administration for approval. Pixie Scientific’s founder said, “You really don’t want to overload parents with data they don’t understand…Eventually, the quantified self idea will be mostly silent and unobtrusive, just something inside the existing flow of life.” [The New York Times]

Horror Stories

US – WellPoint to Pay US $1.7 Million for HIPAA Violations

The U.S. Department of Health and Human Services (HHS) has announced that insurance provider WellPoint has agreed to pay a $1.7 million fine for inadequately protecting a database containing more than 600,000 personal records, according to an HHS press release. Between October 2009 and March 2010, the health data of 612,402 individuals—including names, addresses, birth data and Social Security numbers—was accessible online. The investigation revealed WellPoint “did not have adequate policies and procedures for access to the online application database” that was breached and did not have “technical safeguards” in place for access verification. WellPoint was ordered to pay US $100,000 to the state of Indiana to settle charges resulting from a breach that exposed personal information of 32,000 Indiana patients. [SC Magazine] [ComputerWorld] [BusinessWire] [IT World] See also: [North Carolina: Some security experts criticize Blue Cross’ handling of private data] [Wyndham, LabMD Cases Challenging FTC: Two cases could disrupt FTC’s data security authority]

UK – ICO Fines NHS Surrey Over Patient Data on Resold Hard Drive

NHS Surrey has been fined GBP 200,000 (US $302,000) over data remaining on a hard drive sold on eBay. The storage device held records of nearly 3,000 patients and had been given to a third-party for secure destruction. The drive in question was in a PC that was part of a lot provided to the data destruction company. All the hard drives and data were supposed to be destroyed, and the company had provided certificates saying that the actions agreed upon had been taken. The ICO chastised the hospital for providing inadequate oversight of the data destruction company. [TechWorld] [v3.co.uk]

UK – Sony Drops Fine Appeal

Sony has abandoned its appeal of a GBP 250,000 (US $376,000) fine imposed after a 2011 PlayStation Network (PSN) hack. The UK Information Commissioner’s Office (ICO) fined Sony in January 2013, after finding the company negligent for inadequately protecting PSN user data. Sony initially said it would appeal the fine, but has since changed its position, citing the company’s “commitment to protect[ing] the confidentiality of [its] network security from disclosures in the course of the proceedings.” Sony has stated that it remains opposed to the decision. [BBC.co.uk] [v3.co.uk]

WW – Data Breach Roundup

Four million members of Club Nintendo—Nintendo’s member website—have had their names and contact information illegally accessed, according to the videogame maker. The company has been quick to note that is has not confirmed misuse of this information. “Nintendo confirmed there had been around 15.46 million fraudulent login attempts from June 9 through (last) Thursday, of which 23,926 were successful,” The Japan Times.

An employee at Guilford County Schools in North Carolina sent a PDF containing the names, addresses, grades and other records of 456 rising seniors at Page High School to a student’s guardian. The school district reports that the breach was accidental and was quickly identified and investigated.

Indiana’s Family and Social Services Administration began notifying some 187,533 individuals that the state agency accidentally disclosed their personal information, monthly benefit amounts, some medical information and even Social Security numbers to members of the public. The breach allegedly stemmed from a computer programming error.

Morningstar revealed that it suffered a breach last April, compromising personal information and credit card details from some 2,300 users of its investment research service, Morningstar Document Research. Morningstar further warned that the passwords and e-mail addresses of some 182,000 users may have been illegally accessed. The AP reports that Morningstar offered affected customers a year of free identity protection services.

The Information Commissioner’s Office (ICO) could impose a fine of up to 200,000 GBP on Herefordshire Council following a breach that was reportedly “so sensitive that to reveal its details also risks breaching the Data Protection Act.”

Pulse, a weekly medical publication, published survey results showing that the number of data breaches at 55 UK hospitals increased 20% year-on-year through June 2013. Many of the reported breaches were one-off incidents, giving rise to the possibility that the increase might reflect more thorough reporting practices and awareness rather than increased data theft or inadequate security.

In breach litigation in the U.S., the Tennessee Court of Appeals ruled that a lawsuit stemming from the hacking of Copper Basin Federal Credit Union’s computers can move forward. The lawsuit alleges that the hacking and the resulting illegal transfer of funds was a result of negligence by Fiserv Solutions, a contracted technical support provider. The complaint claims that Fiserv failed to activate the antivirus firewall and protection software it required the credit union to purchase as part of its service contract.

In Missouri, the Office of the Attorney General has determined Schnuck Markets Inc. did not violate Missouri data security law, St. Louis Business Journal reports, noting the determination follows an investigation into a widespread data breach at Schnucks.

The Federal District Court for the Middle District of Florida threw out a class-action lawsuit alleging that employees at Adventist Hospital System’s Florida Hospital Celebration sold patients’ PHI. The dismissal for lack of subject matter jurisdiction notes that as HIPAA/HITECH does not provide for a private right of action, just a regulatory penalty, there was no sufficient federal issue to justify a hearing in federal court. State law, however, may accord the plaintiffs an avenue to pursue their claims.

ID Experts has compiled 12 “top trends in data breach, privacy and security” as enumerated by some of the top minds in the field. Advanced persistent threats—long-term, undetected hacks—and globalized data thieves top the list. A colorful infographic makes things easy for those who want to do less reading. Meanwhile, Corporate Counsel offers advice for communicating with customers following a breach incident.

The University of South Carolina has sent letters to 6,300 students whose personal information may have been on a stolen laptop, Greenville Online reports. The information included Social Security numbers. The school is currently working toward a new cybersecurity program.

A Virginia trooper has been indicted on one felony and eight misdemeanor counts of computer invasion of privacy based on allegations she was improperly using the Virginia Criminal Information Network.

Personal information stolen from Michigan Department of Community Health website: Thieves have obtained the personal information of about 49,000 individuals from Michigan Department of Community Health records, a department spokeswoman confirmed.

Game company Ubisoft has announced its systems have been breached by cybercriminals, recommending users change passwords immediately. The attack divulged user names, email addresses and encrypted passwords, Ubisoft said. The company said it does not store payment information. [Source]

Identity Issues

US – Internet Groups Complain About COPPA Compliance Costs

Internet groups have complained to the FTC that new regulations to protect children’s privacy online are financially burdensome to start-ups. The regulations went into effect July 1 and not only hold sites and apps that collect data from children under 13 responsible for ensuring parental consent but also for any affiliated third-party services collecting data on their sites. The FTC estimates annual compliance costs for current web services at $6,223 and new services at $18,670. The report states 85 to 90 percent of the web services are run by small businesses. [Los Angeles Times]

US – The USPS Is Selling Data to Brokers

The United States Postal Service (USPS) has a relationship with various data brokers. According to the report, the USPS will sell change-of-address information to a data broker provided the firm purchasing the data has the user’s previous address. The USPS National Change-of-Address program (NCOA) approves licenses to approximately 500 companies. “There’s nothing terrible about NCOA, but people should be given a choice,” said privacy expert Bob Gellman. “New movers are fodder for data brokers, who sell mailing lists to marketers and who also maintain lifetime files on every household in America. NCOA is a prime source of this information.” There is, however, a loophole for consumers that prevents data brokers from accessing the updated address. [Forbes] See also: [US: Is IRS Legally Free to Expose Private Info?]

CA – Canadian ePassports Arrive July 1

Starting July 1, Canadians will receive a redesigned ePassport featuring several new security and anti-counterfeiting measures, including an electronic chip that stores the user’s personal information. Travellers are not required to replace their current passports. Older passports will remain valid until their stated expiry date, Passport Canada says. Addressing privacy concerns, the agency says the passport chips can only be read from a 10-centimetre range, making it unlikely that the chip can be read without the user’s knowledge.  Canada is the last G7 country to adopt chip-enhanced passports; over 100 countries, including the U.S., France, Germany and the U.K. already employ ePassports. [Source]

US – Equifax Credit Agency Snags TrustedID

Equifax, one of the three largest U.S. credit-reporting agencies, has acquired TrustedID, which specializes in identity protection. The terms were not disclosed in Monday’s announcement, but AllThingsD pegs the price at about $30 million. Palo Alto, Calif.-based TrustedID, which was founded in 2004, will become part of Equifax Personal Solutions, its direct-to-consumer business unit. Equifax’s interest in the smaller company is threefold: its technology is robust, its existing partner relationships (for example, its exclusive deal with AARP) are coveted, and Equifax’s own credit and identity products could use reinforcement. TrustedID’s data protection abilities reach far, from social media to snail mail. Equifax has previously indicated that it sees the personal data security market as a growth opportunity. [Source]

JP – Train Operators’ e-Ticket ‘Big Data’ Sale Sparks Privacy Backlash

Last week, JR East – Japan’s largest train operator – and Hitachi made a seemingly nondescript announcement that East Japan Railway was selling the anonymized e-ticket histories of millions of passengers as marketing data, and it almost did not get noticed. A few prominent bloggers then highlighted the fact that this is the first time that e-ticket transaction histories would be sold to third parties as marketing data, sparking a storm of discussion that has now spilled over to social networking sites. JR East continues to argue that the data is mostly anonymous. “There is no way to determine the identity of specific individuals from the data, so we feel there is no privacy issue.” [Source]

Internet / WWW

US – Utah ISP Won’t Share Your Data Without a Warrant

A tech company operating in Utah that has spent the past 15 years “resolutely shielding customers’ privacy from government snoops in a way that larger rivals appear to have not.” Xmission is Utah’s first independent and its oldest Internet service provider and has only 30,000 subscribers, but it has cited the Fourth Amendment in order to rebuff dozens of warrantless requests from local and federal law enforcement authorities. “I would tell them I didn’t need to respond if they didn’t have a warrant, that to do so wouldn’t be constitutional,” said Founder and CEO Pete Ashdown. “I’m not an unpaid branch of the government or law enforcement.” [The Guardian]

US – Researcher Finds Health-Related Searches Threaten Privacy

A researcher at the University of Southern California says patients searching for health-related information online may have their privacy threatened. Marco Huesch searched key terms such as “depression,” “herpes” and “cancer” on health-related websites. Using free privacy tools such as DoNotTrackMe and Ghostery, Huesch found third-party entities tracking him. Sampling 20 high-traffic sites, including the Food and Drug Administration and WebMD, at least one third-party entity—and as many as six or seven—were tracking him on each site, he found. Additionally, 13 out of 20 sites contained third-party elements that tracked user data, and seven of those 13 leaked Huesch’s searches to tracking entities, the report states. [AFP] SEE ALSO: [Stalkers use online sex ads as weapon]

WW – Visualizing Your Metadata

The New York Times reports on Immersion, an MIT Media Laboratory project that mines a consenting user’s e-mail metadata and creates an interactive graphic. “The result is a creepy spider web showing all the people you’ve corresponded with, how they know each other and who your closest friends and professional partners are,” the report states. Meanwhile, a German politician who sued a telecommunications company for his phone data over a six-month span has, in conjunction with ZEIT ONLINE , created a mapped visual of his day-to-day life. By combining Green Party Politician Malte Spitz’s phone data, which includes location information, with publicly available data—including information relating to his political life, Twitter feeds and blog entries—a robust and detailed interactive portrait emerges of Spitz’s personal movements. [New York Times] SEE ALSO: [You may already be a winner in NSA’s “three-degrees” surveillance sweepstakes!] and [UK Businesses Get Creative With Consumer Data at the ‘MIDATA’ INNOVATION LAB Launch] [Internet inventor Vint Cerf: No technological cure for privacy ills]

Law Enforcement

US – Security Cameras at Boston’s July 4th Celebration Raise Privacy Concerns

One thing you can expect to see in Boston on this Fourth of July: many, many more police than usual — and many more security cameras too. Law enforcement is responding aggressively to the the security issues raised by the marathon bombings, and the ACLU of Massachusetts is raising privacy concerns. Massachusetts State Police Superintendent Col. Timothy Alben said security cameras are being deployed at and around the Fourth of July events in unprecedented numbers. Operated wirelessly, the cameras’ recordings will be downloaded to a central server, he said, where, from a technical point of view at least, they could be kept indefinitely. “We haven’t developed a policy on how long we’ll keep it,” Col. Alben said. “I think again we did a lot of this in preparation for this particular event. And, as we move forward, we’ll refine the policy, I think, on keeping it.” That lack of refinement has the ACLU of Massachusetts concerned. Kade Crockford, who directs the group’s Technology for Liberty Project, says it is legitimate for law enforcement to deploy such cameras to protect safety at big public events. “That said, I think it’s very troubling that the police do not have a policy to govern the use of these cameras,” she said. Most police which use surveillance cameras do have such policies, Crockford noted. They are needed, she said, to ensure that free-speech protected activities — including anti-federal surveillance protests scheduled for the Fourth of July — are not monitored illegally. [Source]

Location

US – Data Brokers Are Now Selling Your Car’s Location for $10 Online

Forbes reports on the business of license-plate recognition. One data broker, TLO, announced recently it has begun selling location information on license plates that have been filed and identified, and police have started using the technology to track suspects. TLO’s “massive” database claims to add up to 50 million new vehicle sightings each month. “One possible longer term issue around license-plate recognition is that new firms in the field seeking to gain market share could gather specific data such as who was visiting what churches or mosques, underground clubs or medical clinics and perhaps distribute that information more freely than companies now do,” the report states. [Source]

US – States Move on Laws Requiring Warrants for Cellphone Records

The New York Times reports on a recently passed Montana bill that requires police to obtain a search warrant before determining a suspect’s location based on cellphone carrier records. Realizing the value of metadata and the ability of cellphones to track our daily movements, Montana’s governor signed the location information privacy bill—reportedly the first of its kind in the nation—into law on May 6. Other states are working to pass similar bills. Maine’s version is on its way to the governor’s desk, and Massachusetts will hold a legislative hearing on a similar measure next week. [Source] [Source]

Online Privacy

WW – W3C Rejects Ad Industry’s DNT Proposal

The World Wide Web Consortium (W3C) has rejected the Digital Advertising Alliance’s (DAA) draft proposal for a universal Do-Not-Track standard. W3C said the DAA proposal was “less protective of privacy and user choice than their earlier initiatives.” The group says it will instead work from the “June draft,” though even privacy advocates say the draft faces “insurmountable obstacles to adoption by the deadline at the end of this month.” [AdAge] [Daily Examiner] [MediaPost: Mozilla Questions IAB’s Do-Not-Track Estimates] [As the Do Not Track standard unravels, privacy alternatives emerge]

WW – Do-Not-Track Continues To Spark Fires

Microsoft’s newest version of Internet Explorer (IE) allows users to grant permission for specific websites to log their movements. IE11 was debuted in the Windows 8.1 preview last week and features a default Do-Not-Track setting with a “user-granted exceptions” option. Meanwhile, following criticism over its plans to move forward with a project to block third-party cookies in the Firefox browser, Mozilla’s Harvey Anderson said there’s “no constitutional right that allows people to modify my computer.” The Digital Advertising Alliance has called the proposal “draconian.” [IT Pro]

WW – Twitter Adopts DNT by Default

Twitter will begin using cookies to track users and deliver advertising, but because its program abides by Do-Not-Track settings and has a clear opt-out, privacy advocates are praising it. An Electronic Frontier Foundation activist said in a blog post, “We think Twitter is setting an important example for the Internet: It is possible to exist in an ecosystem of tailored advertisements and online tracking while also giving users an easy and meaningful opt-out choice.” Meanwhile, Vine, a video-sharing site owned by Twitter, has added privacy settings to its services—including the ability to make Vines private. [PC Pro]

WW – Facebook Rolls Out Graph Search to Millions

Several hundreds of millions of people will have access to Facebook’s Graph Search beginning this week, six months after its beta testing. The tool is “designed to take any open-ended query and give you links that might have answers,” according to Facebook CEO Mark Zuckerberg. Upon its initial release, the tool prompted concerns that it would compromise the privacy rights of minors. It “makes paying attention to privacy settings much more important if you don’t want embarrassing photos from years ago dredged up or your public contact information scraped,” the report states. [Tech Crunch] SEE ALSO: [Facebook defends Graph Search’s privacy controls for teens | Facebook blog post] and [Facebook’s new promoted-post feature sparks privacy concerns] and also: [How To Opt Out of Receiving Facebook Ads Based on Your Real-Life Shopping Activity]

Other Jurisdictions

AU – Media Companies Told to Adapt to Australia’s New Digital Privacy Laws

Changes to the Privacy Act mean digital publishers face fines of more than $1 million unless they are transparent about personal data they collect and use. The new rules come as the traditional print media targets users who now prefer to use mobile devices through social media sites like Facebook and Twitter. The warning is highlighted in a report released by the consulting group PricewaterhouseCoopers. [Source]

IN – Gov’t Surveillance Raises Trust Concerns

The New York Times reports on India’s Centralized Monitoring System—its new surveillance program—and whether citizens can trust that the government will not infringe on their privacy. The government has said it will abide by laws mandating that it receive proper authorization prior to intercepting communications and that privacy will be better protected. “But there are a host of reasons why the citizens of India should be skeptical of those official claims,” the report states. [Source]

Privacy (US)

US – How First PCLOB Meeting Affects Private Firms

At the Privacy and Civil Liberties Oversight Board’s first public meeting since its reemergence under new Chairman David Medine, the focus was very precise: What direct and concrete improvements could be made to improve “Surveillance Programs Operated Pursuant to Section 215 of the USA PATRIOT Act and Section 702 of Foreign Intelligence Surveillance Act.” Ideas generated included making the FISA Court adversarial, decreasing the vagueness around “data minimization ,” instituting a data retention law and a number of other suggestions. [The Privacy Advisor]

US – Judge Grants Chevron Access to Activists’ Online Data

A U.S. federal judge has ruled to allow Chevron, via subpoena to Microsoft, Google and Yahoo, access to the IP usage records of more than 100 environmental activists, journalists and attorneys. The company has requested the records to piece together a lawsuit alleging the oil company was the victim of a conspiracy ending up in an $18.2 billion judgment against it for the dumping of 18.5 billion gallons of oil waste in the Ecuadorean Amazon, the report states. The Electronic Frontier Foundation’s Marcia Hoffman said, “These sweeping subpoenas create a chilling effect among those who have spoken out…” The subpoena, according to ERI, requests personal information of each account holder and every login over a nine-year period. [Common Dreams]

US – The Future of Consumer Privacy Class Actions

The New York Law Journal explores the potential future of consumer privacy class-action lawsuits in light of the recent comScore decision, noting that it and “other recent decisions allowing privacy cases to proceed in the absence of actual damages suggest that the legal landscape may be changing, and that privacy could be the next significant frontier in class-action litigation.” Meanwhile, The Sun Sentinel reports malpractice lawyers have argued that a new Florida law, Ch. 2013-108, may violate patient privacy. [Source]

US – Children’s Privacy Suits To Be Heard in NJ

The U.S. Judicial Panel on Multidistrict Legislation has sent six class-action lawsuits alleging Google and Viacom “violate children’s privacy by using cookies to track their Internet use and target them for ads” to New Jersey to be heard. A nationwide class-action was filed back in December in Texas by Stephanie Fryar, who “claimed that when her sons registered and created profiles on three Viacom-operated websites…the defendants placed a doubleclick.net cookie ‘id’ on the children’s computers to track their communications to those websites and others,” the report states, noting similar cases were filed in California, Illinois, Missouri, New Jersey and Pennsylvania. [Courthouse News Service] [National Law Journal]

US – Leslie Harris to Step Down at CDT

Leslie Harris, who has headed the Center for Democracy & Technology (CDT) since 2005, announced this month that she will resign from her post in March of 2014, just as the CDT celebrates its 20th anniversary. Harris made it clear that she is not retiring but rather “right-sizing,” and she is hardly done with her work in the privacy arena. Hear her thoughts on CPOs’ human rights obligations, the status of current legislation, where CDT goes from here and more. [Source]

US – DHS Secretary Napolitano Resigns to Head University of California System

Homeland Security Secretary Janet Napolitano, who led the burgeoning Department of Homeland Security through a host of policy changes in the era after the Sept. 11, 2001 attacks on the U.S., is resigning to head the University of California system. Napolitano, just the third person to lead the 10-year-old department, told her senior staff Friday she would be leaving to become the president of the University of California system. The university also announced Napolitano’s nomination to be the 20th president of the statewide system. A former Arizona governor and attorney general, Napolitano was appointed by President Barack Obama in 2008. She had led the department through a series of policy changes with respect to protecting the public safety, including a focus on enforcing immigration laws. [Source]

Privacy Enhancing Technologies (PETs)

WW – Pirate Bay Founder Aims to Create Spy-Proof Messaging App

It took 36 hours for users to contribute $100,000 to fund an app designed to avoid government spy agencies. The app, called Heml.is, is Swedish for “secret.” It aims to give users an alternative to major tech companies. “We’re building a message app where no one can listen in, not even us,” the creators said of the product. Pirate Bay founder Peter Sunde is working with app developers to create a mobile messaging application that uses end-to-end encryption, which means that only the sender and the recipient will be able to read messages. Sunde says there will not be ads on the app and that it will not sell user data to advertisers. The funding will come solely from users, who will have to pay extra to use certain features, such as sending images. [CNET] [ComputerWorld] [Source] See also: [Kremlin Returns to Typewriters]

WW – New Privacy Enhancing Technology Preserves Web Anonymity and Privacy

Ontario’s Information and Privacy Commissioner, Dr. Ann Cavoukian, presented the 2013 Award for Outstanding Research in Privacy Enhancing Technologies (PET) Award via video at Indiana University in Bloomington, Indiana. Dr. Cavoukian and Microsoft co-sponsor of the award, which was created in 2003 to encourage the development of technology to protect privacy, rather than to threaten it. The winners are selected by a global panel of leading technology researchers. The winning paper “Adversarial Stylometry: Circumventing Authorship Recognition to Preserve Privacy and Anonymity” is based on research conducted by Sadia Afroz, Michael Brennan, and Rachel Greenstadt. The paper examined methods for defeating stylometry which has recently been revolutionized online with advances in computer algorithms. The privacy concern which arise from stylometry is that it can be used to reliably link anonymous or pseudonymous text to identifiable individuals. In order to lessen these risks, the authors developed software called “Anonymouth” that assists users by suggesting modifications to their text defeat stylometry. [Source] [More information about the privacy technology awards]

UK – Anonymisation Network Launched at University of Manchester

The University of Manchester has launched a new expert network that will help businesses to safely manage and share sensitive information. The UK Anonymisation Network (UKAN) was supported by the University and is now led by Dr Mark Elliot, who is based at The University of Manchester’s School of Social Sciences. Funding was provided by the UK Information Commissioner, while the Open Data Institute also offered support alongside the Office for National Statistics and the University of Southampton. UKAN will provide advice to organisations and companies on how to reduce the risks around holding personal details of individuals and the inadvertent sharing of data. The network aims to lay a foundation of best practice for anonymisation and give advice to anyone who handles sensitive data, especially those in health, education and policing.  UKAN will help to deliver the Government’s Transparency Initiative, which hopes to dispel any culture of data secrecy within Government departments, public bodies, businesses and other organisations.“The network will also provide important best practice advice on how data can be successfully anonymised in compliance with the UK Data Protection Act,“ said Christopher Graham, UK Privacy Commissioner. [Source]

Security

WW – Chinese CERT Reports Increases in Mobile Malware – 80% on Android

According to data from the National Computer Network Emergency Response Team/Coordination Center of China (CNCERT/CC), China experienced a 25-fold increase in detected mobile malware samples between 2011 and 2012. More than 80% of the malware samples targeted Android devices. Forty percent of the malware was designed to launch fee-based services on the mobile devices. CNCERT/CC also reported that in 2012, 73,000 Trojan and botnet command-and-control servers hijacked 14.2 million host machines in that country. [ComputerWorld] [ZDNet] [PCWprld] See also: [Critical Android Flaw Lets Attackers Insert Code Into Signed Apps] and [South Korean Defense Ministry to Prohibit Certain Smartphone Functionality]

US – CTO Tests Company Employee’s Phishing Smarts

Several weeks ago, the chief technology officer at Atlantic Media sent out a phony phishing email to all 450 company employees. The message appeared to come from Google Apps and asked recipients to click on a link to confirm their account information. When the employees clicked on the link, they were taken to a website that revealed the security test. About 120 employees clicked on the link. Another 120 opened the message but did not click on the link. CTO Tom Cochran noted, “Telling someone that something is bad can happen is not as good as demonstrating it.” The remaining employees either called or messaged Cochran about the suspicious message, and some flagged it in their inboxes. While Cochran believes in the value of security education for employees, Bruce Schneier says they are a waste of companies’ time and money, because “you’re only as strong as your worst offender.” Schneier noted that a better choice would be “investment in systems that take user mistakes out of the loop.” [SCMagazine]

US – Symantec Releases Mobile Privacy Product

Symantec has released a new privacy product capable of scanning a mobile device for data an application may be leaking about the user. Norton Mobile Security for Android devices checks for “malicious applications, privacy risks and potentially risky behavior.” While Norton’s suite of mobile security products have typically focused on malicious threats, Michael Lin, vice president of Symantec Mobility Solutions, said that this latest solution reacts to the fact that “now we are seeing threats impact mobile applications and data being shared without the user’s knowledge or consent.” This latest product aims to “protect users from these types of privacy threats as well.” [Source]

Surveillance

WW – Spying Reports Give Momentum to ECPA Reforms, Spur Legal Actions

Revelations about the U.S. NSA surveillance of domestic and foreign communications should add momentum to the already politically charged atmosphere surrounding updates to the U.S. Electronic Communications Privacy Act—and on both sides of the aisle, Politico reports. Already, Senate Judiciary Committee Chairman Patrick Leahy (D-VT) has co-sponsored a reform bill, and House Judiciary Committee Chairman Bob Goodlatte (R-VA) has pledged to make the issue a priority. In the UK, lawyers for Privacy International have filed legal papers calling for an immediate suspension of Britain’s use of material from the NSA’s PRISM program, and in the U.S., The New York Times reports on EPIC’s plans to file an emergency petition with the Supreme Court today asking that it stop the NSA’s surveillance program altogether. The Hill discusses “five unanswered questions about the NSA’s surveillance programs,” including the scope of the programs, additional data being collected under the USA PATRIOT Act and other programs the public may not be aware of, and The Guardian reports on the NSA’s bumpy ride at a recruitment drive on a U.S. college campus last week. See also [‘America has no functioning democracy’ – Jimmy Carter on NSA

EU – EU Officials, U.S. Privacy Group Seek Answers, Action

PC World reports the “European Parliament gave European Commissioners and national ministers some extra ammunition Thursday in discussions with the U.S. following allegations about American spying and the PRISM scandal: possible suspension of data-sharing agreements.” The European Parliament is asking the U.S. “to provide full disclosure of any spying activities” and has established an inquiry to review the allegations, but it “stopped short of suspending bilateral trade talks due to start on Monday,” the report states. Meanwhile, the European Commission has written to the UK for answers about its surveillance program, Tempora. In the U.S., the Electronic Privacy Information Center’s Domestic Surveillance Project announced Thursday that it plans to file a petition with the Supreme Court “to vacate the Foreign Surveillance Intelligence Court ruling” authorizing the NSA’s collection of metadata on U.S. phone calls. [Source] SEE ALSO: [Claims that France has Internet spying program similar to America’s hugely embarrassing to Hollande]

EU – German Chancellor Calls for New ISP Agreement; NSA Fallout Continues

German Chancellor Angela Merkel has called for a strict European agreement on data protection that would require all ISPs operating in Europe to reveal the personal information they keep and with whom they share it. Merkel has suggested that the requirement could be codified within the International Covenant on Civil and Political Rights, but there’s some doubt as to the feasibility of that. Meanwhile, EU Justice Commissioner Viviane Reding said revelations surrounding the U.S. National Security Agency’s surveillance program helped add momentum to the case of those already calling for stronger data protection measures in the EU. Meanwhile, Politico reports on privacy issues’ impact on U.S.-EU trade talks. [CNN] See also: [No Feds at DEF CON, What Comes Next?]

US – Brick-and-Mortar Tracking on the Rise

Last year, department store Nordstrom sought to learn more about its customers by testing a new technology that allowed it to track customers’ movements via the WiFi signals from their cell phones. But when it posted a sign telling customers they were being tracked, it heard complaints and eventually ended the program. “The creepy thing isn’t the privacy violation, it’s how much they can infer,” said one shopper. An increasing number of businesses now offer the technology for brick-and-mortar shops to track users like digital shops can. Meanwhile, the ACLU has criticized AT&T’s plans to sell anonymous customer location data, saying customers can be identified. [The New York Times] [Senator Franken Letter to Euclid] See also: [TTC suspends covert camera use]

Telecom / TV

US – AT&T Privacy Policy Updated, May Start Selling Anonymous User Data

AT&T has a new privacy policy and may begin selling anonymized user data to third parties. The company cites “more relevant advertising” as its reason for selling the data, joining other big tech companies in the practice. AT&T will offer customers the opportunity to opt out, and plans to sell demographic and device information as well as information on viewing behavior through its television service. Pointing to Verizon’s use of consumer data, AT&T’s privacy policy states, “we similarly plan to provide our customers with these sorts of personalized services, and we’re committed to doing so in line with our long-standing policy to respect and protect our customers’ privacy.” [Slashgear]

US Government Programs

US – NSA Files Show Microsoft Encryption Was Bypassed

The Guardian reports on documents obtained from Edward Snowden on the U.S. National Security Agency’s (NSA) surveillance programs that indicate encryption was bypassed to access documents. The documents show “Microsoft helped the NSA to circumvent its encryption” and the NSA had “pre-encryption stage access to e-mail on Outlook.com, including Hotmail,” the report states. Microsoft has responded, “When we upgrade or update products, we aren’t absolved from the need to comply with existing or future lawful demands,” noting customer information is only provided “in response to government demands, and we only ever comply with orders for requests about specific accounts or identifiers.” Meanwhile, The New York Times reports that Sen. Ron Wyden (D-OR) has said he believes the NSA may soon abandon the practice of collecting bulk phone records.[Source] See also: [US-Made Internet Monitoring Tools Detected on Networks in Sudan, Iran, and Syria]

US – FISA Court Wants Obama to Declassify Yahoo Case

The U.S. Foreign Intelligence Surveillance Court has ordered the Justice Department to review a 2008 secret court opinion—allegedly requiring Yahoo to turn over online communications of its consumers—to determine how much it can publicly release. Judge Reggie B. Walton also called on the Justice Department to review the arguments Yahoo and the government made in the case. Walton would then publicly release the court’s justification. Meanwhile, the Electronic Frontier Foundation has recognized Yahoo “with a star of special distinction” in their Who Has Your Back survey “for fighting for its users in (secret) courts.” [The Washington Post] See also: [For NSA chief, terrorist threat drives passion to ‘collect it all,’ observers say] [Can Gov’t Safely Use FISA To Justify Surveillance?]

US – Postal Service Tracking, Retaining Images of Mail

The New York Times reports on a little-known but long-running surveillance system by the United States Postal Service (USPS). Leslie James Pickering, a bookstore owner who, a decade ago, was spokesman for a radical environmental group flagged by the FBI as eco-terrorists, noticed a handwritten card mistakingly delivered with his mail stating any mail headed to his address should be shown to a supervisor first. He was being tracked by the Mail Isolation Control and Tracking program, in which the USPS photographs the exterior of every piece of paper mail processed in the U.S. The more-than-a-century-old program provides such images to law enforcement officials who request them, the report states. [Source]

US – Updated COPPA Rules Now in Effect

The US Federal Trade Commission’s (FTC’s) revised rules for the Children’s Online Privacy Protection Act of 1998 (COPPA) took effect on July 1, 2013. The law prohibits the collection of personal data from children without first obtaining verifiable parental consent. It also requires websites to have clear and accessible privacy policies, and to ensure the security of information it collects from children under age 13. The updated rules specify that personal information now includes “geolocation information and persistent identifiers that can be used to recognize a user over time and across different websites or online services,” and photos, videos, and sound recordings. COPPA applies to smartphone apps as well as websites. [Information Week] [COPPA Amendments]

US – NPPC Joins in Lawsuit over EPA Privacy Breach

The American Farm Bureau Federation and the National Pork Producers Council (NPPC) have jointly filed a federal lawsuit and temporary restraining order to halt disclosures of farmers’ personal information by the U.S. Environmental Protection Agency (EPA). The move comes after the EPA released the personal information of tens of thousands of farmers, including names, addresses and personal contact information, after a number of Freedom of Information requests by animal rights groups. Filed before the U.S. District Court for the District of Minnesota, the order seeks to stop the disclosures and clarify the EPA’s role in keeping personal data private in such circumstances. [National Hog Farmer]

US Legislation

US – Florida Attorneys Work to Overturn Malpractice Law

Five lawsuits filed in state and federal courts on Monday claim a new Florida state law (SB 1792) violates patients’ privacy rights. The law, which went into effect on Monday, aims to protect doctors facing malpractice suits and, according to one complaint, authorizes “unlimited and unfettered release of personal health information to those defendants without the valid consent of claimants.” “The law allows—but does not require—any healthcare provider called as a witness to breach patient confidentiality and give the defendant’s attorneys information about a patient’s treatment,” reports The Miami Herald. The provision applies only to the pre-filing informal fact-finding period; once a suit is filed, court rules apply.The suits, filed in Tallahassee, West Palm Beach and Miami federal courts and in state courts in Pensacola and Fort Lauderdale, claim this provision contravenes HIPAA.

US – Missouri Gov. Vetoes Workers’ Compensation Database

Missouri Gov. Jay Nixon axed a bill that would have created a database of workers who have filed workers’ compensation claims in the state. The law would’ve allowed employers to input job applicants’ names and Social Security numbers into the database to see whether they had filed a claim, the date of the claim and its status. According to a report in The Republic, Missouri’s Division of Workers’ Compensation estimated the database would start out with 554,000 records, adding about 13,000 per year.

US – Senate Issues Draft Cybersecurity Bill

The US Senate is circulating a draft cybersecurity bill. A similar measure failed last year. The bill aims to establish voluntary cybersecurity standards for organizations that operate elements of the country’s critical infrastructure. It also calls for increased research and development in cybersecurity defenses and increased software vulnerability information sharing. [NextGov] [The Register]

Workplace Privacy

US – Court Ruling Impacts BYOD

What happens to an employee’s expectation of privacy regarding her personal e-mails on her company-issued Blackberry after she leaves the company? If a recent ruling by the U.S. District Court for the Northern District of Ohio stands up to further scrutiny, the answer could be that a former employee has greater expectations of privacy after her departure than while she was still employed. In Lazette v. Kulmatycki, the court ruled the Stored Communications Act (SCA) applies to unauthorized access of employees’ personal e-mail accounts, among other determinations. [Source]

CA – Enforcement of Privacy Policy in Steel v. Coast Capital Savings Credit Union

In a recent decision of the British Columbia Supreme Court, the Court upheld the termination for cause of a help desk analyst in the IT department who had been employed for over 20 years at Coast Capital Savings Credit Union. (Steel v. Coast Capital Savings Credit Union, 2013 BCSC 527) Employees at Coast were permitted to have a personal folder in which they would keep confidential business documents. Under the privacy policy at Coast, the files in the personal folder could only be read or edited by the employee who had the folder. Help desk employees were allowed to access personal folders but could only do so to resolve a technical problem and only if the employee who had the personal folder first gave permission to the help desk to access the folder. The restrictions on access to personal folders were clearly set out in the privacy policy at Coast. An employee tried to open a confidential spreadsheet in her personal folder. She got a message on her screen that the document was already in use by the help desk. The document in question was a waiting list of employees for parking spots. This was a confidential document that had information about employees’ seniority and rates of pay. The help desk employee had not requested permission to view the document in the other employee’s personal folder. She accessed it because she was curious about the waiting list for parking. Coast terminated her employment on the basis of breach of the trust “that is required in a position that holds access to confidential and private information.” Coast stated that it no longer had confidence in her. The Supreme Court decided that the help desk employee was in a position of trust because she was “given the ability to access confidential documents” as a result of her position on the help desk. She was not allowed to do that without the consent of the other employee. The Court stated that, “the employer had to trust Ms. Steel to obey its policies and follow the protocols. It had to trust Ms. Steel to only access such documents as part of the performance of her duties and follow the protocols when she did so. Such trust was fundamental to the employment relationship in relation to Ms. Steel’s position.” Accordingly, the Court upheld the termination for cause. The Court’s decision to uphold the termination for cause of an employee with over 20 years of service for a single breach of the privacy policy is a clear indication that Courts are prepared to treat privacy issues very seriously. If employees in a position of trust violate privacy policies, they may well be subject to termination for cause. [Source]

US – BYOD Spurs Worker Worry About Personal Privacy

Employers aren’t the only ones worried about workers using their own mobile devices in the office, new research shows. A study by network access solutions provider Aruba Networks revealed that BYOD , which is the term used for employees using personal smartphones and tablets for work purposes, is causing workers to be fearful of their employer checking out their personal information. Specifically, 45% of U.S. workers worry about giving their company’s IT department access to their personal data, and 46% said they would feel violated if their IT staff were to access any personal information contained on their mobile devices. The research found that these concerns are leading many employees to keep their personal devices away from the IT department, thus putting company data at risk. Nearly 20% of U.S. workers have not told their employers that they use a personal mobile device for work. The study discovered that some employees are so insistent on keeping their mobile-device use private that they would delay or fail to inform their employer about a data breach. More than 10% of those surveyed would not report that their personal device had been compromised, even if it leaked company data, and 36% would wait before reporting the data breach. [Source]

UK – Home Office Asks Supreme Court to Make Landmark Privacy Ruling

Britain’s Supreme Court judges are being asked to make a controversial ruling on whether the criminal records disclosure system infringes the human rights of some former offenders, preventing them from getting jobs. Home Office lawyers are asking the Supreme Court justices to overturn an Appeal Court ruling that the records disclosure system violated the human rights of some people who argue that previous incidents, where they got into trouble with the police, should be kept secret. Lawyers say the hearing later this month will result in one of the UK’s most important privacy rulings to date and could further provoke critics of human rights laws who are already angry at a recent European Court ruling that criticised Britain for its system of indeterminate life sentences for people convicted of the most serious offences, including multiple murders. Some MPs have argued for tightening rules on the reporting of convictions, particularly serious ones, to deter offenders from even applying for jobs working with the vulnerable. But civil liberties campaigners claim the existing rules mean that teenage “indiscretions” can blight employment prospects for a lifetime. The Appeal Court said the records disclosure regime legitimately sought to protect employers and children or vulnerable adults, but held that the disclosure of all convictions and cautions was “disproportionate” to that aim. An independent review of the disclosure regime has already recommended the introduction of a filter to remove minor and old convictions where appropriate, but the Government says it is still considering the issue. The UK government has already faced criticism from Strasbourg on this issue after it ruled that blanket notification rules imposed on sex offenders without the possibility of review breached their human rights. David Cameron described that decision as “appalling”. The far-reaching implications of any Supreme Court ruling became clear after The IoS learnt that vetting checks on people applying for jobs in “caring professions” have turned up almost a quarter of a million crimes in the past two years alone. Nick Pickles, director of the civil liberties group Big Brother Watch, said: “The risk-averse culture within the public sector has meant people struggle to get a second chance if they have any blemish on their past.” [Source]

+++

16-30 June 2013

Canada

CA – Poor Data Breach Tracking, Reporting Concerns Privacy Commissioner

Canada’s privacy czar has singled out several federal departments for their lacklustre approach to data breaches, citing a need for better reporting, security and tracking protocols. Jennifer Stoddart’s office has compiled a preliminary list of agencies with potentially worrisome patterns when it comes to the loss of Canadians’ personal information. The analysis is based on departmental figures tabled in Parliament in April in response to a question from New Democrat MP Charlie Angus. The response indicated there were more than 3,000 data breaches over a 10-year period affecting about 725,000 Canadians. After taking a close look at the numbers, the privacy commissioner identified nine departments and agencies that may lack adequate reporting mechanisms, have faulty security procedures or require improved tracking protocols. During a recent meeting, Stoddart urged Treasury Board President Tony Clement to amend privacy law to make reporting of federal data breaches mandatory. [Source]

CA – Gun Registry Data to Be Deleted in Quebec: Court

A Quebec court has sided with the Harper government, saying the province has no right to the federal long-gun registry data. Quebec’s highest court has ruled against the provincial government, which is trying to save data for that province from being destroyed. “Quebec has no property right in the data,” said the 14-page verdict. The data does not belong to Quebec, and the provinces have no control over it. The Parliament of Canada, which considers the data at issue to be pointless and inefficient, and believes that its existence in a registry infringes the right to privacy, can certainly decide to stop compiling and preserving that information,” it noted. Various observers have predicted the issue will wind up before the Supreme Court. The long-gun registry was scrapped in the rest of Canada last year, but remains operational in Quebec following a series of injunctions safeguarding the Quebec data and ordering the registry be maintained while the federal-provincial battle plays out in court. [Source]

CA – Saskatchewan Privacy Rights in Lag Behind Rest of West: Report

Saskatchewan’s Information and Privacy Commissioner says this province is lagging behind its neighbours in Western Canada in both privacy and access to information matters. Gary Dickson, who released his final annual report this week, says citizens of British Columbia and Alberta have stronger rights in these areas than people in Saskatchewan. His second five-year term as information and privacy commissioner ends April 27, 2014. In his report, Dickson says when it comes to access and privacy, “Saskatchewan is still a have-not province.” Dickson said he’d like to see administrative responsibility for privacy and access cases be moved out of the Ministry of Justice, citing concerns that the ministry takes an adversarial role. Another ministry might be better suited to promoting citizens’ access and privacy rights, he said. [Source] SEE ALSO: [Regina police aren’t required to identify pin pad fraud businesses] and [Canadians questioning privacy rights]

CA – Alberta Commissioner Rules Against Secret Trucker Database

This recent decision of the Privacy Commissioner of Alberta (Professional Drivers Bureau of Canada Inc. Case File Number P1884) deals with the collection of personal information of truck drivers by a private service company, called the “Professional Drivers Bureau”. This company collected personal information about drivers from trucking companies, created a database of information, and then offered a search service, by which trucking companies paid a fee for a report on the driver. In that report, the personal information about the driver was disclosed to the trucking company. The personal information was gleaned and compiled into a database over a long period of time, and it became clear during the Commissioner’s investigation that the individuals never consented to this collection, use and disclosure. The Commissioner ultimately decided that the “Professional Drivers Bureau” was in breach of Alberta privacy laws because it never obtained consent directly from the individual truck drivers. [Source]

CA – Alberta Premier Wants Anonymous Online Tool to Report Bullying

Alberta could soon move to implement a system to allow for anonymous online reporting of bullying in real-time and is also looking to give police enhanced powers to combat the harassment and abuse of young people, says Premier Alison Redford. With bullying a hot topic at Monday’s Western Premiers’ Conference, Redford said she would like to follow the path of British Columbia, which brought in an online reporting mechanism as part of its “Erase Bullying” initiative in the wake of the suicide of bullied teenager Amanda Todd. B.C. Premier Christy Clark said the system allows students to report incidents of bullying as they are happening. School personnel are notified immediately as are emergency personnel, if necessary, she told reporters at the premiers’ closing news conference. As a followup, professionals at the district level connect with the school to provide support in dealing with the bully and the victim appropriately. “The important thing about this, though, is that it’s not an app that you load on to your iPhone, because kids don’t want to have a fink app on their iPhone. “It’s an online reporting tool that you can go to on the web,” said Clark, who said there are “thousands” of cases of bullying occurring daily, but youth are afraid to report them because of the potential for retribution. [Source]

Consumer

US – Retailer Sued for Collecting Customer Zip Codes

Urban Outfitters Inc., is facing a class action in Washington federal court over allegations the clothing retailer collected customer zip codes in violation of District of Columbia consumer protection laws. The complaint, filed June 21 in U.S. District Court for the District of Columbia, accused Urban Outfitters Inc. of asking for customer zip codes in a way that implied the information was required to complete a credit card transaction. The plaintiffs claimed Urban Outfitters, which also owns Anthropologie-brand stores, used the zip codes to track down customer addresses for marketing purposes. [Source]

UK – Biz Launches Data-Driven Car Insurance for Youth

UK-based Tesco Bank has launched a new car insurance service that tracks and analyzes driver behavior to determine policy rates. Called Box Insurance, the company places technology in a customer’s vehicle and uses telematics data from the car, which is then sent to the insurer’s data center for analysis. The Association of British Insurers recently posted an advisory note warning that companies must be transparent about their data use, stating, “Consumers need to trust insurers to treat them fairly and protect their personal information.” Tesco has said it will “keep all your data, including driving data, safe and confidential,” adding that it won’t “share driving data with the police or other bodies without a court order or your consent, unless we suspect fraud.” [Information Age]

E-Government

CA – Taxpayers Assured Protection When Lodging Complaints Against Taxman

Canada’s taxpayers’ ombudsman is offering help for people who fear there may be a backlash if they lodge a complaint against the revenue department. Ombudsman J. Paul Dube has made an addition to the Canadian Taxpayers Bill of Rights that says Canadians are entitled to lodge service complaints and request formal reviews without fear of reprisal from the CRA. Dube says the new right was created because some taxpayers fear exercising their rights when dealing with the CRA. [Source] SEE ALSO: [Two CRA employees violated privacy laws for years before being caught, reports show] and [ON: Watchdog slams McGuinty’s office over deleted emails]

US – Plans for Data-Sharing Steeped in Privacy Concerns

Virginia state plans to implement a data system aimed at improving student preparation for college and workforce. The talks have been steeped in privacy concerns surrounding student data, which school officials well understand based on recent news on the National Security Agency’s surveillance methods. “This is not the greatest time in government to be talking about the cool data we collect,” said a spokesman for the Virginia Education Department. “It’s right for parents to be concerned about privacy. We share that concern.” The system would allow agencies to share data to track student progress, helping officials to create policies around the most successful routes. [The Washington Post]

CA – New App Could Let Citizens Report Illegal Parking, Get Cut of Fine

A new app called SpotSquad could soon pay people to report parking infrastions to authorities. The concept is simple, says Chris Johnson, co-founder of the app: when someone sees a parking violation, they simply need to open up the app on their smartphone, upload a photo, choose the type of infraction and submit it – the photo is then sent to regional parking authorities who can dispatch a ticket warden. If the tip results in a fine, tipsters get a cut deposited into their bank accounts or donated to their favourite charities – as much as 10 or 20%, says Johnson. The group haven’t yet struck any deals but say they’re open to working with municipalities and private parking lot operators. A similar app already exists in the U.S. Texas-based Parking Mobility runs a program that allows trained volunteers to take photos of cars parked in disabled spots. Rewards are paid out to charities or parking offender rehabilitation programs. The program works because the organization has spent years negotiating agreements with police departments and cities. The group has also launched a pilot project in Vancouver but results have been disappointing. Unlike in the U.S., tipsters are prohibited from reporting on violations made on private property. The Canadian app, SpotSquad, could open up a legal minefield, according to a Winnipeg lawyer specializing in privacy and social media law. Public sector workers who do similar work are bound by privacy laws, lawyer Brian Bowman told CTV Winnipeg. That wouldn’t be the case with this app. “You are empowering citizens and paying them to arguably act as an agent for you,” he said. [Source]

E-Mail

US –Texas Governor Signs Strict eMail Privacy Bill

Texas Governor Rick Perry has signed House Bill 2268 into law. The measure requires that law enforcement obtain a warrant before snooping on email. The law takes effect immediately. The law makes Texas the first state to have a law that is more stringent that the federal Electronic Communications Privacy Act (ECPA), which requires a warrant only for unopened email that is less than 180 days old. [Source] [Source] SEE ALSO: [GEIST: Is the Government About to Can Its Own Anti-Spam Law?]

EU Developments

EU – France Gives Google 3 Months to Address User Data Privacy Concerns

French data privacy body, Commission Nationale de l’Informatique et des Libertes (CNIL), has given Google three months to implement changes to the way it collects and manages customer data. The commission found Google to be in violation of the French Data Protection Act. CNIL’s June 10 decision lists the changes it expects from Google, including explaining to users how the data they collect will be used, and not retaining data beyond the time necessary for the purpose for which they were collected. If Google does not comply with the order, the company could face sanctions. Google is facing enforcement action over privacy practices in several other EU countries, including Spain and Germany. [CNET] [The Register] [ComputerWorld] [Reuters]

EU – Albrecht: Reports Suggest NSA Intercepted Regulation Data

“If the actual revelations on these spying activities are true, then it is completely clear that there have been also interceptions with the activities of this regulation,” German Green MEP Jan Philip Albrecht said of the EU’s draft data protection regulation in response to this weekend’s reports on the U.S. National Security Agency (NSA) allegedly spying on EU activities. Lobbying efforts against the draft regulation by the U.S. government and U.S.-based companies, quoting Albrecht as saying, “Perhaps it’s time to re-discuss once more if we really want to completely exclude national security from the scope of the regulation.” A European Commission spokeswoman has called the weekend allegations “disturbing” and said the European External Action Service has asked Secretary of State John Kerry to respond. [EUObserver] SEE ALSO: [Ars Technica: Students Challenge Firms Over NSA Data Transfers]

EU – Rule Sets Out Data Breach Notification Expectations for Telecoms and ISPs

The European Union has issued new regulations describing the responsibilities of telecommunications companies and ISPs when they experience data breaches. The incidents must be reported to data protection authorities within 24 hours of their discovery. The companies must report the size and nature of the breach, what data were compromised, and what steps they have taken to address the issue with customers. Businesses and consumers will be told of the breach if it “is likely to adversely affect personal data or privacy.” That decision will be made by the national data protection authorities using a test to be provided by the European Commission. Notification of authorities has been required for several years, but the new regulation establishes specific details. Companies can be exempt from the requirements if they encrypt data. [PC World] [ZDNet]

EU – Search Engine Not Controller, EU Court Rules

The EU’s top court ruled that Internet search engines cannot be considered “the controller” of personal data hosted on other websites. EU Court of Justice Advocate General Niilo Jaeaeskinen said in a nonbinding opinion, “A national data protection authority cannot require an Internet search engine service provider to withdraw information from its index.” The case, C-131/12 , stems from approximately 200 orders from Spain’s Data Protection Authority for Google to remove personal data from indexed websites. A spokesman for Google said, “This is a good opinion for free expression…We’re glad to see it supports our long-held view that requiring search engines to suppress ‘legitimate and legal information’ would amount to censorship.” [Bloomberg]

EU – Court Backs Google in Privacy Case

Google must respect EU privacy law but is not obliged to delete sensitive information from its search index, an adviser to the highest EU court said, in a case that tests whether people can have harmful content erased from the Web. The adviser backed the internet search giant’s position that it cannot erase legal content from the internet even if it is harmful to an individual. But he rejected the view of many U.S. internet firms that they are not bound by EU privacy law. “Requesting search engine service providers to suppress legitimate and legal information that has entered the public domain would entail an interference with the freedom of expression,” the Luxembourg-based court said in a statement setting out Advocate General Niilo Jaaskinen’s opinion. While internet-based firms operating in the European Union must adhere to national data protection laws, that did not oblige them to remove personal content produced by third parties, the statement said. “Search engine service providers are not responsible, on the basis of the Data Protection Directive, for personal data appearing on web pages they process.” Lawyers agree that Google’s search algorithms, which hunt and list weblinks based on how relevant they may be, would not be in a position to “know” whether data was personal or not. A final judgment on the case is expected before the end of the year. [Source]

EU – Taking Photos in Private Settings to Be Illegal in Sweden

Sweden has taken the unusual step of making it illegal for take pictures in private environments without permission. The new privacy law takes effect July 1, and it carries with it some strict penalties, ranging from a fine to a jail term of up to  two years. That gives judges some ability to harshly punish someone taking secret video of people in changing rooms, while being more lenient on someone who took otherwise innocent photos in a person’s home. The new law would also make certain other acts illegal, such as installing a camera intended to take secret photos, even if no photos are actually taken. Critics say the law is a bit vague, as everyone’s definition of a private environment is different. A supermarket may be open to the public, but it’s privately owned. Exceptions are made in the law for journalists, though the Swedish Union of Journalists stands in opposition to it. “What’s unfortunate about this law that the parliament has approved is that a professional photographer doesn’t know when he raises the camera to take a picture if he is committing a criminal act or not,” explains board member Stephen Lindholm. “The risk is that pictures that should be taken aren’t because of fear of committing a crime.” [Source]

EU – Italian Garante Concerned About Government Measures

The president of Italy’s Data Protection Authority, the Garante, has voiced concerns about the Italian government’s recent measures aimed at simplifying the country’s data protection code. Garante President Antonello Soro’s concerns are that the government measures are “in breach of the EU Directive, Lisbon Treaty and Italian laws as well.” [Source]

Facts & Stats

WW – Firms Take 10 Hours to Spot Data Breaches, Mcafee Finds

The average organisation believes it would spot a data breach in 10 hours, a McAfee global survey of IT professionals has found. But is that result good, indifferent or an indication of the downright complacent? The firm’s interrogation of 500 decision makers from the US, UK, Germany and Australia earlier this year found that 22% thought they’d need a day to recognise a breach, with one in 20 offering a week as a likely timescale. Just over a third said they would notice data breaches in a matter of minutes, which counts as real-time by today’s standards. In terms of general security, three quarters confidently reckoned they could assess their security in real-time, with about the same number talking up their ability to spot insider threats, perimeter threats and even zero-day malware. All of this was despite 58% admitting they had suffered a data breach in the last year with only a quarter spotting that fact within minutes. When trying to locate the source of the breach – the most important aspect of any detection and remediation regime – a third said it took a day and 16% as long as a week. In McAfee’s view the general optimism buried in some of these numbers belies the probability that many organisations over-estimate both the speed at which they notice breaches and their ability to quickly trace their source. Third parties have backed them up on this, especially a survey from security vendor Trustwave that found that many data breaches take months to spot, with the average being 210 days; 14% take longer than two years. [Source]

MX – Study Highlights Data Breach Concerns

A Unisys study has found that 82% of Mexicans are “very concerned” about data breaches. The study showed that of the survey’s 1,052 respondents, most are concerned about breaches at banks and financial institutions followed by those at healthcare organizations, government agencies and telcos and Internet service providers. “Anxiety related to data breaches in Mexico seems pervasive and continues to persist despite efforts by governments and commercial organizations to secure consumers’ financial data,” the report states. However, the survey also found low reporting for cybercrime. [BNamericas]

Finance

CH – Swiss Court Stops Handover of Credit Suisse Employee’s Data to U.S.

A Swiss court has ordered an injunction halting the transfer of a former Credit Suisse employee’s data to U.S. tax authorities. The ruling highlights Switzerland’s difficulties in balancing traditions of personal privacy against U.S. demands for data from roughly a dozen Swiss banks under formal investigation by U.S. prosecutors. Those banks, including Zurich-based Credit Suisse, have been handing over information on their U.S. dealings for months now, part of efforts to avoid indictment and minimise fines for their role in helping wealthy While these banks have clinched special Swiss government permission to deliver business data – but no client files – parliament failed last week to back a draft law covering the wider Swiss banking industry. While the court ruling is for one person’s data, “it will set a precedent and could be repeated for other employees who had access to U.S. clients.”.[Source] SEE ALSO: [Payment Privacy: Are Untraceable Purchases Ever Okay?] and [Bank’s new cybersecurity audits catch law firms flat-footed]

FOI

US – FISA Court Says Google and Microsoft May Disclose Procedural Information

The US Foreign Intelligence Surveillance Court has granted Microsoft and Google the right to disclose “procedural information” related to their legal challenges of gag orders that accompany national security requests. These orders prohibit the companies from disclosing details about the data they provide to the government. The companies want to clear their names of allegations that they gave the NSA unfettered access to their servers. Both companies say they provide data only when they receive a legal request supported by a court order. [The Register] [Politico] [CNET] [Source] [Source] [Source]

WW – Google Adds Malware Statistics to Transparency Report

Google will be adding statistics about malware to its transparency report. Google’s transparency report currently documents criminal requests and national security requests from governments worldwide, though it does not include requests from the federal government’s FISA regarding Google’s foreign users. Since that court made headlines this month, Google and other tech companies have been trying to contain the public relations crisis that has resulted from revelations that they have been aiding government surveillance efforts when ordered to by the court. Google has since filed a legal motion asking the government to relax its gag order and allow the company to disclose the number of FISA requests it receives. At the same time, Google said it would also be expanding its transparency report to include new numbers around malware and phishing attacks on the Internet. In 2006, Google started searching for, and flagging, suspect Web sites for its users. It is now flagging some 10,000 sites a day. The company said its transparency report would now document how many people see its security warnings each week, where malicious sites were hosted around the world (and by which ISPs), how long it took for Web masters to clean up their sites, and how quickly Web sites got re-infected after they were scrubbed of malware. As an example, during the first week of June, Google detected 37,000 legitimate sites that had been compromised to host malware and 4,000 sites that were created specifically to host malware. Earlier this year, it took websites an average of 50 days to clear themselves of reported malware. Google has been working on gathering relevant statistics for the last six months and that Google would begin updating its transparency report weekly. [The New York Times] [DarkReading] [eWeek] [CNET] [Ars Technica] [h-online] [SC Magazine] [Google.com] SEE ALSO: [Peter Fleischer: Mirror, mirror on the wall, who is the ugliest one of them all?]

Genetics

US – Experts Propose Consolidating DNA Databases

This month an international group of nearly 80 researchers, patient advocates, universities and organizations like the National Institutes of Health announced that it wants to consolidate the world’s databases of DNA and other genetic information, making data easier for researchers to retrieve and share. But the security and privacy of the study subjects are paramount concerns, said Dr. David Altshuler of the Broad Institute of Harvard and M.I.T., a leader of the group. “The problems are not yet solved in any general way,” Dr. Altshuler said. “We want to work to solve them.” For years now, a steady stream of research has eroded scientists’ faith that DNA can be held anonymously. [New York Times]

Health / Medical

WW – Health Group Releases mHealth Study; Privacy in HTML5 Era

A new study by a mobile health advocacy group states there is not a “one-size-fits-all” resolution for mobile privacy legislation. The mHealth Alliance report, Patient Privacy in a Mobile World: A Framework To Address Privacy Law Issues in Mobile Health , also has provided a mobile privacy toolkit for using mobile health technology. The evolving nature of mobile technology “makes it difficult, and some may say ill-advised, to create rigid legal rules that may not fit future mHeath applications or worse that may hamper their development in the first place,” the study states. Meanwhile, CIO reports on how to ensure privacy in the age of HTML5. [Thomson Reuters]

CA – B.C. Health Ministry Told to Strengthen Privacy Practices

Elizabeth Denham ruled that there was a “lack of clear responsibility for privacy within the ministry” at the time of the breaches. She believed this was due, in part, to a lack of clear leadership and clarity of roles. “Ministry privacy governance was further weakened by a complete lack of audit and review of employee and contractor functions relating to privacy,” she wrote. “There were no mechanisms to ensure that researchers were complying with the privacy requirements, as stipulated in contracts and written agreements, and to ensure ministry employees were taking appropriate privacy training and following privacy policies. As a result, ministry employees were able to download large amounts of personal health data on to unencrypted flash drives and share it with unauthorized persons, undetected.” Ms. Denham concluded her report with 11 recommendations, including that the ministry implement technical security measures to prevent unauthorized information transfer; create a program to monitor and audit compliance by employees and contracted researchers; and ensure employees with access to such databases participate in mandatory privacy training. The ministry has accepted and will be implementing all of Ms. Denham’s recommendations, newly appointed Health Minister Terry Lake said. [Source] SEE ALSO: [Doctors experiment with social media and apps] NS [US: Ingestible smart pills are a hard act to swallow] and [UK: Health watchdog destroyed report in maternity hospital to spare its own blushes]

WW – For Sale: Ingestible Computers to Monitor Your Health

A new wave of prescription pills can e-mail your doctor after being swallowed. Ingestible computers in pill-form can now monitor health data and share it wirelessly with doctors. The pills stay intact throughout the intestinal tract and are powered through stomach acids. The Electronic Frontier Foundation says such a pill has wonderful and terrible aspects. “The wonderful is that there are a great number of things you want to know about yourself on a continual basis…The terrible is that health insurance companies could know about the inner workings of your body.” [The New York Times]

Horror Stories

US – AG Report Reveals Breaches Affect 2.5 Million in 2012

According to a first-of-its-kind report released by California Attorney General Kamala Harris, 2.5 million Californians had personal information put at risk because of electronic data breaches in 2012. Had companies encrypted data when sending it outside of a network, 1.4 million Californians would have been protected. Retail establishments were the worst offenders. Noting the dangers inherent to individuals’ privacy, finances and even personal security, Harris said companies and government agencies “must do more to protect people by protecting data.” [Source]

WW – Facebook Says Technical Flaw Exposed 6 Million Users

Facebook has inadvertently exposed six million users’ phone numbers and e-mail addresses to unauthorized viewers over the last year, the company said. Facebook blamed the data leaks, which began in 2012, on a technical flaw in its huge archive of contact information collected from its 1.1 billion users worldwide. As a result of the problem, Facebook users who downloaded contact data for their list of friends obtained additional information that they were not supposed to have. Facebook’s security team was alerted to the problem last week and fixed it within 24 hours. But Facebook did not publicly acknowledge the flaw until the next week, when it published a message on its blog explaining the situation. A Facebook spokesman said the delay was because of a company procedure stipulating that regulators and affected users be notified before making a public announcement. [The New York Times] SEE ALSO: [Facebook’s White Hat Program Helped Uncover Glitch]

CA – BC Lab Loses Personal Info of 16,000 Patients

About 16,000 patients in Kamloops who used LifeLabs’ medical-lab service in the last six years are being warned their personal information may have been compromised. LifeLabs president Sue Paish says a computer was sent to their main office in Burnaby for servicing, and when it was returned the hard drive was missing. The hard drive held the results of ECGs, or electrocardiograms, and was removed sometime last January. Paish issued an apology for the incident and added the information is password protected and requires special equipment to read. Health Minister Terry Lake learned of the breach last week and wonders why it took so long to notify both the government and the privacy commissioner. Lake says he’s been assured by LifeLabs that it won’t happen again. [Source]  Meanwhile, in other news: the personal data of 47,000 Florida teachers was exposed during a data transfer at Florida State University. The personal information was available online for approximately 14 days, according to the state’s Department of Education; Blizzard Entertainment has asked a California federal judge to dismiss a multi-million dollar class-action filed after a data breach, stating the plaintiffs have not alleged “actual harm.” And Seattle: Detective’s stolen laptop puts thousands at risk of identity theft.

US – Carnegie Mellon Publishes Empirical Analysis of Data Breach Litigation

Forbes reports on what organizations can do if they are the unlucky victims of a high-profile data breach. “At a minimum,” the article states, “start providing credit monitoring for victims to reduce litigation risk.” That’s according to researchers at Carnegie Mellon University and Temple University who found a six-fold reduction of being sued in federal court for those who provide credit monitoring. The paper, “Empirical Analysis of Data Breach Litigation ,” also found a 10-fold increase in litigation if the incident was a cyberattack rather than lost or improperly disclosed data. [Source]

Identity Issues

US – Brill Calls for “Reclaim Your Name” Program

Federal Trade Commissioner Julie Brill has called on Congress to legislate a “Reclaim Your Name” program. Suggesting that Big Data brokers are “taking advantage of us without our permission,” the program Brill has called for would establish technical controls allowing users to access the information data controllers have stored about them, then control it and correct it, the report states. The program could work in tandem with the still-being-negotiated Do-Not-Track (DNT) mechanism, Brill said, adding that she urges “the W3C stakeholders to forge ahead and reach consensus” on DNT. The Direct Marketing Association expressed surprise at Brill’s announcement, noting it has been in talks with her recently on increasing transparency. [AdAge] [Text of Speech to CFP] SEE ALSO: [Forbes: Acxiom Access Feature Delayed But Imminent]

CA – Wearing a Mask at a Riot Is Now a Crime

A bill that bans the wearing of masks during a riot or unlawful assembly and carries a maximum 10-year prison sentence with a conviction of the offence became law. Bill C-309, a private member’s bill introduced by Conservative MP Blake Richards in 2011, passed third reading in the Senate on May 23 and was proclaimed law during a royal assent ceremony in the Senate. Richards, MP for Wild Rose, Alta., said the bill is meant to give police an added tool to prevent lawful protests from becoming violent riots, and that it will help police identify people who engage in vandalism or other illegal acts. The bill is something that police, municipal authorities and businesses hit hard by riots in Toronto, Vancouver, Montreal and other cities in recent years, were asking for, according to Richards. The bill creates a new Criminal Code offence that makes it illegal to wear a mask or otherwise conceal your identity during a riot or unlawful assembly. Exceptions can be made if someone can prove they have a “lawful excuse” for covering their face such as religious or medical reasons. The bill originally proposed a penalty of up to five years, but the House of Commons justice committee amended it and doubled the penalty to up to 10 years in prison for committing the offence. Civil liberties advocates argued the measures could create a chilling effect on free speech and that peaceful protesters can unintentionally find themselves involved in an unlawful assembly. They also noted that there are legitimate reasons for wearing masks at protests; some may be worried about reprisals at work, for example, if sighted at a political protest. [Source]

WW – Yahoo Plans to Recycle Dormant User IDs

Yahoo plans to recycle Yahoo user IDs that have been inactive for a year or more. The company is aware of concerns about the old IDs falling into hands of people with malicious intents, but says it is going to “extraordinary lengths to ensure that nothing bad happens to our users.” One concern that has been voiced is that is someone acquiring a Yahoo ID that is linked with someone’s Gmail account could request a password reset for the Gmail account and take control of it. The same thing could potentially be done with social media and financial accounts. Yahoo released a statement noting that “any personal data and private content associated with these accounts will be deleted and will not be accessible to the account holder.” [CNET] [WIRED] SEE [“Own the email, own the person“]

Intellectual Property

US – $675,000 Filesharing Verdict Upheld

The US Court of Appeals for the First Circuit has ruled that a US$675,000 verdict against Joel Tenenbaum for filesharing is justified. In the ruling, the court wrote that although Sony was suing him for just 30 songs, Tenenbaum appears to have made many more songs than that available for sharing. In addition, “During discovery, Tenenbaum lied about his activities. Only at trial did [he] admit that he had distributed as many as five thousand songs.” [Ars Technica] [Document Cloud]

US – US Seized 1,700 Domains Over Three Years in Anti-Piracy Operation

“Operation In Our Sites,” an ongoing effort by US authorities to thwart intellectual property fraud, has seized more than 1,700 websites in the past three years. The offending sites offered illegally streamed sporting events; sold bogus apparel, accessories and counterfeit drugs; and allowed illegal downloads of music and movies. US authorities were
able to seize the sites because the domains – .net, .com, and .org – are controlled by US entities. [WIRED]

US – Pandora Says Music Streams Not Covered By Privacy Law

Pandora is asking the Ninth Circuit Court of Appeals to uphold a decision by a U.S. District Court that the company did not violate a Michigan privacy law by allegedly sharing web users’ music-listening history with their Facebook friends. U.S. District Court Judge Saundra Brown Armstrong dismissed a potential class-action lawsuit that Pandora violated Michigan’s Video Rental Privacy Act by participating in Facebook’s “instant personalization” program. Armstrong ruled the act doesn’t apply when companies “stream” tracks, as opposed to lending, renting or selling them, the report states. The suit’s plaintiff wants his claim revived, but Pandora says Armstrong was correct in her ruling. [MediaPost News]

Law Enforcement

US – FBI Confirms Drone Use, Says It’s Limited

FBI Director Robert Mueller testified to the U.S. Senate that the Federal Bureau of Investigation (FBI) sometimes uses drones for surveillance efforts. “It’s very seldom used and generally used in a particular incident when you need the capability,” Mueller said. “It’s very narrowly focused on particularized cases and particularized needs.” The testimony follows concerns by lawmakers and civil liberties advocates as revelations emerge on the government’s interception of U.S. citizens’ communications via its PRISM program. But the debate on drones has been ongoing. Mueller said the FBI is beginning to formulate privacy guidelines on the technology. [Bloomberg] [Drones Are Easy To Acquire, Lack Regulation]

US – Blood, Spit and Cops: Nationwide Drug Roadblocks Raise Eyebrows

The roadblocks went up at several points in two Alabama towns, about 40 miles on either side of Birmingham. For the next two days, off-duty sheriff’s deputies in St. Clair County, to the east, and Bibb County, to the southwest, flagged down motorists and steered them toward federal highway safety researchers. The researchers asked them a few questions about drinking and drug use and asked them for breath, saliva and blood samples — offering them $10 for saliva and $50 to give blood. It’s not just in Alabama. The roadblocks are part of a national study led by the National Highway Traffic Safety Administration, which is trying to determine how many drivers are on the road with drugs or alcohol in their systems. Similar roadblocks will be erected in dozens of communities across the nation this year, according to the agency. It’s been going on for decades. Previous surveys date to the 1970s. The last one was run in 2007, and it included the collection of blood and saliva samples without apparent controversy, sheriff’s spokesmen in both Alabama counties said. But this time, it’s happening as the Obama administration struggles to explain revelations that U.S. spy organizations have been tracking phone and Internet traffic. Against that backdrop, the NHTSA-backed roadblocks have led to complaints in Alabama about an intrusive federal government. Susan Watson, executive director of the Alabama chapter of the ACLU, called the use of deputies to conduct the survey an “abuse of power.” Even though the survey is voluntary, people still feel they need to comply when asked by a police officer, she said. “How voluntary is it when you have a police officer in uniform flagging you down?” Watson asked. “Are you going to stop? Yes, you’re going to stop.” The agency said the 8,000 drivers expected to take part will do so voluntarily and anonymously, and researchers follow “a highly scientific protocol and complex statistical design in order to accurately reflect the problem nationwide.” [Source]

Offshore

CH – China’s First-Ever National Standard on Data Privacy

The Information Security Technology-Guide for Personal Information Protection within Public and Commercial Systems (“Guidelines”), China’s first-ever national standard for personal data privacy protection, came into effect on February 1, 2013. The Guidelines, while not legally binding, are just what they purport to be – guidelines – some commentators view these as technical guidelines. However, the Guidelines should not be taken lightly as this may be a pre-cursor of new legislation ahead. China is not quite ready to issue new binding legislation, but there are indications it seeks to develop consistency with other internationally accepted practices, especially following recent data legislation enacted in the region by neighboring Hong Kong and other Asian countries. [Mondaq News]

SK – Presidential Office Hacked

A hacking attack on the presidential office has resulted in the leak of 100,000 individuals’ personal information. The information includes names, birth dates, ID numbers and both online and offline addresses, the report states. Users’ registration
numbers—similar to Social Security numbers—were not affected because they were encrypted. The presidential office has issued an apology and is offering compensation to those affected. [ZDNet]

Online Privacy

EU – Working Group: Default Should Be No Tracking

The EU’s International Working Group on Data Protection has released a whitepaper on online behavioral advertising, reports the Electronic Privacy Information Center. The working group says in its release that World Wide Web Consortium efforts to create a Do-Not-Track mechanism could serve as a “sugar pill instead of a proper cure and would such be useless.” The working group recommends that the default setting be that users are not tracked. [Paper] SEE ALSO: [Forbes: The Web Cookie Is Dying. Here’s The Creepier Technology That Comes Next]

WW – W3C Moves Forward on June Draft; Group Launches Privacy Controls

ZDNet reports on two developments in the Do-Not-Track initiative. First, those participating in a World Wide Web Consortium conference call agreed to accept a draft of the standard in an effort to work toward “Last Call,” when the proposal is brought for a vote. The draft is being dubbed the June Draft. Also, Mozilla has teamed up with Stanford’s Center for Internet Society to announce it is launching its own set of privacy controls on the web. Called a “Cookie Clearinghouse,” it will allow users to create and maintain “allow lists” and “block lists,” the report states. [Source]

WW – IAB Disapproves of Cookie Clearinghouse

Mozilla’s involvement with The Center for Internet and Society at Stanford Law School in an effort to improve Internet privacy is a “Kangaroo cookie court” according to the Interactive Advertising Bureau (IAB). The IAB disapproves of the ongoing project called the “Cookie Clearinghouse,” a control system that allows users to maintain a “block” and “allow” list when it comes to cookies. But the IAB says the system “replaces the principle of consumer choice with a ‘Mozilla knows best’ system.” Mozilla said it hopes the IAB and other industry groups will get involved in the project to better the user experience [CNET].

WW – Creepy Facebook Apps Mine Your Profile for Bikini Shots, Break-Up Status

Facebook isn’t to blame. More and more apps built to take advantage of the Facebook social network’s very social tools are hopping the fence from useful and crossing over into downright creepy territory. I looked at several of these apps, which handle tasks such as searching for photos of your friends in their bikinis to notifying you about people who are newly single, to see just how disturbing they are. Some worked more or less as advertised. Others failed miserably, which is good news, as some of the very concepts made my skin crawl. [Source] SEE ALSO: [New York Times: Data You Can Believe In: The Obama Campaign’s Digital Masterminds Cash In]

Other Jurisdictions

IN – CCTV Not Covered in Draft Law

Those whose images are captured via CCTV in public places “will not be able to invoke the proposed privacy law to seek redress.” That is one provision of the draft privacy bill “likely to be tabled in Parliament’s forthcoming session,” the report states, noting the bill does include the creation of a national body to hold individuals, organizations and others accountable for audio and video recording. The bill “addresses the home ministry’s concern that interception laws must not change and that footage from security cameras in public places are kept out of the ambit of the new law,” officials said. [The Indian Express

AU – Breach Notification Laws Fail to Pass Before Break

The Australian Senate has failed to pass mandatory data breach notification reform laws, which were expected to go into effect by March of next year. The Senate has now taken its break until the next election. The proposed law was described by the Australian Law Reform Commission in 2008 as a “long-overdue measure,” Business Spectator reports. The Senate did pass laws last week requiring commonwealth public officials to report suspected wrongdoing, reports The Register. Meanwhile, a new report says that many Australian data-driven firms are using consumer data to support existing beliefs rather than “achieve fresh insights.” [Business Spectator] [AUS: Banks slam new privacy proposal] see also: [NZ: Govt chief information officer role to be expanded]

Privacy (US)

US – NSA Outlines Steps to Reduce Leaks

To prevent Edward Snowden-type leaks, the National Security Agency is considering a number of measures, including reducing the number of systems administrators it employs, NSA Director Keith Alexander says. The agency also is considering requiring individuals with top-secret security clearance to be partnered to access certain classified documents. Testifying on June 18 before the House Select Permanent Committee on Intelligence, Alexander said the NSA employs at least 1,000 systems administrators with security clearances, most of whom are on the payrolls of government contractors. “About 12 to 13 years ago, as we tried to downsize our government workforce, we pushed more of our information technology workforce, our systems administrators, to the contract arena,” Alexander said. “That’s consistent across the intelligence community.” [Source] [ZDNet] [ComputerWorld] [WIRED] [Privacy groups skeptical of plan to limit NSA’s data access]

US – Former NSA Official Says Anti-Leak Technology Not Deployed

A former NSA cybersecurity official said that when he left the agency in the summer of 2012, there was no anti-leak technology on NSA networks. After Bradley Manning’s alleged data theft came to light, the US Department of Defense rolled out a Host Based Security System (HBSS) to detect unauthorized activity on DOD networks. One of the system’s features is to monitor removable data devices, like those allegedly used by Bradley and more recently by Edward Snowden. The official said that the HBSS was not installed on NSA networks as of last summer. He also commented on NSA Director General Keith Alexander’s plan to have the NSA use a two-person rule for data access, saying that it could prove too cumbersome for specialists who need to do fast-paced work, and noted that “the best safeguard would be locking down the content at the source.” [NextGov]

US – Senators Say NSA Inaccurate on Protections

Two senators on the intelligence committee have accused the National Security Agency (NSA) of publicly presenting inaccurate statements about the privacy protections on its surveillance of millions of Internet communications. However, Sens. Ron Wyden (D-OR) and Mark Udall (D-CO) say they cannot identify the inaccuracies within a factsheet without exposing classified information. In a letter written to NSA Director Gen. Keith Alexander, the senators wrote they were “disappointed to see that this factsheet contains an inaccurate statement about how the section 702 authority has been interpreted by the U.S. government…this inaccuracy is significant, as it portrays protections for Americans’ privacy as being significantly stronger than they actually are.” [The Guardian]

US – Former U.S. Rep. Bono Joins Leibowitz to Co-Chair New Privacy Coalition

A group of the nation’s largest telecommunications companies have founded the 21st Century Privacy Coalition. The coalition will be co-chaired by former Federal Trade Commission Chairman Jon Leibowitz and former U.S. Rep. Mary Bono. Founding members include AT&T, Comcast, CTIA-The Wireless Association, Directv, Time Warner Cable, Verizon and the U.S. Telecom Association. In an exclusive interview with the IAPP, Bono said the coalition has nothing to do with the recent NSA revelations and has in fact been in the works for some time, dating back to when she was still serving as chairwoman for the Subcommittee of Commerce, Manufacturing and Trade. “It was clear there was a need,” she said. [Adweek]

US – New COPPA Rules Take Effect Today; Marketers May Not Be Ready

Jeff John Roberts discusses what COPPA’s new rules mean for marketers. The revised law comes into effect today and can impose penalties of up to $16,000 per violation. Many app developers may not be prepared for the rules, which require parental consent before collecting basic data on children. Fast Company predicts three outcomes following today’s implementation of the law: The privacy business–including Safe Harbor programs and privacy lawyers–will boom; sites will neglect to ask users’ age, and/or a “chilling effect” will take place on the development of educational apps and games. [GigaOm]

US – Advocates: Facebook Settlement Not Enough

At a recent hearing, children’s advocates worked to convince U.S. District Judge Richard Seeborg that last year’s proposed settlement of a case surrounding Facebook’s Sponsored Stories doesn’t do enough to protect children’s information. The Children’s Advocacy Institute argued that minors’ content should be off limits to advertisers, but Seeborg—without indicating how he would rule—noted that his function “is not to craft the perfect policy for minors” but only to say whether the settlement is fair. Seeborg gave initial approval of the settlement last year, but it still needs his final sign-off. [Reuters]

US – FTC, Ireland DPA Sign Enforcement Assistance Memorandum

FTC Chairwoman Edith Ramirez and Ireland Data Protection Commissioner Billy Hawkes have signed a memorandum of understanding (MOU) to “promote increased understanding and communication” between both agencies, an FTC press release states. Ramirez said the MOU “is a step forward for the FTC in cross-border privacy enforcement.” Hawkes said he “very much welcomes this important development, which I believe will have valuable assistance to my office…” [The Privacy Advisor]

US – FBI Scanning Driver’s License Images

The FBI has gained access to driver’s license photos for residents of Nebraska, Illinois, South Carolina, Utah, North Carolina, Delaware, Texas and other states to hunt for suspects in criminal investigations. In memorandums obtained through a Freedom of Information Act request by the Electronic Privacy Information Center, the FBI is authorized to search state databases, which include images and personal information. “The anticipated result of that search will be a photo gallery of potential matches. These potential matches (candidates) will be forwarded to the FBI, along with any associated information stored with the photo.” The agreements between the state motor vehicle divisions and the FBI allow the FBI to use facial recognition systems to compare subjects of investigations to the millions of license and identification photos retained by states. EPIC’s letter explained: “The increasing expansion of facial recognition technology carries with it a number of privacy and security concerns. Facial recognition data is personally identifiable information and improper collection, storage, and use of this information can result in identity theft or inaccurate identifications. “Additionally, an individual’s ability to control access to his or her identity, including determining when to reveal it, is an essential aspect of personal security that facial recognition technology erodes. Finally, ubiquitous and near-effortless identification eliminates individuals’ ability to control their identities, posing special risk to protesters engaging in lawful, anonymous speech. The U.S. Supreme Court has repeatedly upheld the right to engage in political speech anonymously.” [Source] [Police Using Driver’s License Photo Databases in Criminal Investigations]

US – Privacy Committee Hearings on Driver’s License Applicants

A Missouri House committee formed to investigate the Department of Revenue’s scanning of driver’s license applicants’ documents has begun two days of hearings into the controversy. The first witness to testify before the House Bipartisan Investigative Committee on Privacy Protection was Jackie Bemboom, head of the Department of Revenue’s Motor Vehicle and Driver’s License division. She testified under oath that they are not trying to comply with the federal Real I-D Act of 2005, but that several of their procedures coincide with Real I-D. “Real I-D asks for the photo to be on the license,” Bemboom saisd. “Real I-D asks for a database, and we’ve been doing a database since 1939.” But committee member and Osage County Sheriff Michael Dixon said Revenue officials have complied with 34 out of 39 items, giving the impression that the department is trying to comply with Real I-D. Bemboom maintains that the scanning and storing of source documents is being done to combat fraud. The chair of the committee, Republican House Member Stanley Cox of Sedalia, said several officials from Governor Nixon’s office were set to appear Wednesday, but have since canceled. [Source]

US – Privacy Groups Push Back Against License Plate Database

The massive storage of license plate and vehicle data by law enforcement agencies across Southern California is sparking a debate over the privacy rights of citizens in their cars. Through interagency agreements among the Los Angeles and San Bernardino county sheriff’s departments and more than 30 police departments, cameras called Automated License Plate Readers — mounted to police cruisers or in fixed locations — capture the data on millions of cars across the region. License plate numbers and a vehicle location history are then automatically fed into and permanently stored on one of three databases. On average, a cruiser equipped with an ALPR camera can collect data on 10,000 cars in a single shift, according to industry reports. A lawsuit filed by two privacy rights groups says each of the 7 million registered cars in greater Los Angeles has had its license plate scanned an average of 22 times since the program launched. The curation of so much information on personal vehicles has raised the ire of privacy groups, which are beginning to push back against the data mining efforts of Los Angeles County’s two largest law enforcement agencies. [Source] SEE ALSO: [E-License Plate: Wave of the Future or Menace?]

US – Supreme Court Bars Lawyers From Accessing Drivers’ Database

The U.S. Supreme Court has ruled that lawyers cannot gather personal information about drivers from state databases when seeking plaintiffs for potential lawsuits. The court held in a narrow 5-4 vote that the federal Drivers Privacy Protection Act of 1994 does not allow lawyers to seek the information. The case hinged on language in the law that allows access to the data for lawyers pursuing an “investigation in anticipation of litigation.” A group of drivers sued lawyers who had sought the personal information from the South Carolina Department of Motor Vehicles. The lawyers were seeking to file a lawsuit on behalf of customers against car dealerships over alleged unlawful administrative fees. In the majority opinion, Justice Anthony Kennedy said that “an attorney’s solicitation of clients” did not fit into the section of the law that refers to litigation. What the law protected, he added, was the right of lawyers to seek information in ongoing cases in which they already represent someone. The case is Maracich, et al v. Spears, et al, U.S. Supreme Court, No. 12-25. [Source]

US – PCLOB Public Workshop on Surveillance to be Held

Following the Privacy and Civil Liberties Oversight Board (PCLOB) meeting with President Barack Obama last week, the PCLOB has set a public meeting for July 9 to discuss the National Security Agency (NSA) surveillance programs. The PCLOB “will conduct a public workshop with invited experts, academics and advocacy organizations regarding surveillance programs operated pursuant to Section 215 of the USA PATRIOT Act and Section 702 of Foreign Intelligence Surveillance Act,” according to the workshop notice. The meeting will be held in Washington, DC, but the specific location has not yet been announced. [Politico] SEE ALSO: [SWIRE: Why the New Senator Markey May Be the Most Influential Privacy Congressman in History]

US – Video Game Industry Releases Guidelines for Mobile, COPPA

The group that manages privacy self-regulation for the video game industry, the Entertainment Software Rating Board (ESRB), has increased its program to include mobile apps and the upcoming changes to the Children’s Online Privacy Protection Act (COPPA). With COPPA changes to go into effect July 1, the group focused on ways of obtaining parental consent, creating short-form privacy notices for apps and dealing with the expanded definition of personal data to include photos and videos, the report states. Dona Fraser, vice president of the ESRB Privacy Certified program, said “achieving compliance with requirements like COPPA can be complicated, particularly for rapidly evolving platforms like mobile.” The ESRB is also in the process of issuing certifications to its members and awaits Safe Harbor status from the FTC. [AdWeek]

US – The Use of Predictive Policing, Campaigning

New predictive policing programs are being used in Seattle, WA. Using a combination of Google Maps, license-plate readers and computer algorithms, police are able to crunch data to predict where crimes are most likely to occur. Some worry about privacy and civil liberties issues. Meanwhile, Big Data analytics is also being used to better understand and reach out to potential political supporters. Calling it the “new electioneering,” the Times reports on one company that mines online data—particularly social media—and publicly available information to “quantify and measure voter emotion and opinion online.” [New York Times]

US – Database Prompts Call for Monitoring

Louisiana’s Board of Elementary and Secondary Education is appointing a task force to monitor data-sharing in the wake of the Department of Education’s partnership with inBloom, a database created to track student progress. Citing parent and student concerns about the potential for others to access private student data, the report quotes Education Superintendent John White’s comments that the department data will not be sold to outside companies and will be secured behind firewalls. “We’re not suggesting this is a perfect process,” he said. “But we hope we can get to a point where the public understands and trusts that this is being done the right way.” [The Times-Picayune]

US – Ramirez Taps Privacy Expert to Head Bureau of Consumer Protection

The FTC announced Chairwoman Edith Ramirez’s appointment of seven senior staff members, including Jessica Rich, a privacy expert who will now serve as director of the Bureau of Consumer Protection. Rich says that privacy is an area in which the FTC believes consumer protection is very important, and that, in line with Chairwoman Edith Remirez’s emphasis that the agency plans to be aggressive on privacy, the commission will use the tools in its belt to “the fullest extent possible” to protect consumers, including Section 5 of the FTC Act, the Fair Credit Reporting Act and COPPA. [Press Release]

US – Wong Named White House’s Deputy CTO

The Obama administration has announced its hire of Nicole Wong, who most recently worked for Twitter, as the White House’s deputy U.S. chief technology officer. Wong has also served as vice president and deputy general counsel of Google. “She has tremendous expertise in these domains and an unrivaled reputation for fairness, and we look forward to having her on our team,” said Rick Weiss, director of strategic communications at the Office of Science and Technology Policy. [The Recorder]

Privacy Enhancing Technologies (PETs)

WW – Firefox Web Browser to Move Ahead With ‘Do Not Track’ Option

The maker of the popular Firefox browser is moving ahead with plans to block the most common forms of Internet tracking, allowing hundreds of millions of users to eventually limit who watches their movements across the Web, company officials said. Firefox made the decision despite intense resistance from advertising groups, which have argued that tracking is essential to delivering well-targeted, lucrative ads that pay for many popular Internet services. When Firefox’s maker, Mozilla, first suggested in February that it might limit blocking, one advertising executive called it “a nuclear first strike” against the industry. To help navigate the complexities of when to allow tracking, Mozilla has teamed up with Stanford University’s Center for Internet and Society to create a “Cookie Clearinghouse,” which will advise the company on how to tweak its settings to protect users. Makers of the Opera Web browser have also joined the Stanford-led initiative. [Source]

WW – Using Virtual Assistants to Guide Privacy Settings

To help navigate convoluted and complex privacy settings on commonly used websites, CNET News columnist Dan Farber proposes that virtual assistants, such as Siri and Google Now, can be effective tools to give users more control of their settings. Virtual assistant apps could also help educate users on how their data is being collected, processed and shared. “Instead of reading pages of text,” Farber suggests, “users could query a virtual assistant, which could walk them through their privacy settings.” As virtual assistants “gain more popularity, managing privacy and protecting your online persona will be more of a continuous, background process handled by an intelligent agent rather than a sometimes impenetrable chore.” [CNET] [How UI and UX Can KO Privacy]

Security

WW – Organizations are Not Doing Enough to Defend Against Cybercrime

According to the 2013 State of Cybercrime Survey from PwC, “Organizations are misjudging the severity of risks they face from a financial, reputational, and regulatory perspective.” Current defenses against cyberattacks are not effective because executives either do not understand the scope and import of the threats, or they have stopped paying attention. Many leaders are unaware of who in their organizations is responsible for cybersecurity. They also “underestimate the capabilities of their attackers and the damage they can cause.” The leaders also appear not to understand that, while using smart cloud services and other technological advances may help productivity, they introduce their own vulnerabilities. [CSO Online] [PWC Press Release]

US – CERT Issues Default Password Alert

The US Computer Emergency Response Team (US-CERT) has issued an alert warning that “it is imperative to change default manufacturer passwords and restrict network access to critical and important systems.” The alert notes that “critical infrastructure and other important embedded systems, appliances, and devices are of particular concern.” [Dark Reading] [US CERT]

Surveillance

US – Another NSA Revelation: Stellar Wind

The Guardian continues to publish news of secret, warrantless surveillance programs undertaken by the NSA. This week, the paper has news of an operation called Stellar Wind, which ran from 2001 through 2011, collecting “the accounts to which Americans sent e-mails and from which they received e-mails. It also details the Internet protocol addresses used by people inside the United States when sending e-mails–information which can reflect their physical location. It did not include the content of e-mails.” All “communications with at least one communicant outside the United States or for which no communicant was known to be a citizen of the United States” were fair game, approved by the FISA court every 90 days for a decade. [Source]

US – Senators Want “Public Answers” About Scope of NSA Surveillance

US legislators are calling for “public answers” regarding the scope of the National Security Agency’s (NSA’s) surveillance of people in the US. In their letter to Director of National Intelligence James R. Clapper, the group of 26 senators asks if the NSA collected personal information, such as credit card purchases, library records, and firearms sales, in addition to phone records. The senators also ask if the collected data include cell-site location data. [ComputerWorld] [Washington Post] [Text of Letter]

US – Revising What We Know About PRISM

Initial reports about the NSA’s PRISM surveillance program appear to have gotten the technical details of the program wrong. The stories reported that nine major US Internet companies knowingly allowed NSA access to information on their servers. While the information leak discloses the scope of the NSA’s surveillance, the PRISM system described in a leaked PowerPoint presentation apparently helps automate the FBI and NSA requests for data; it does not allow those agencies unfettered access to the servers. PRISM is part of a much larger NSA data-grab, which has been known about for years, in which data are siphoned from the fiber optic cables through which they travel along the Internet’s backbone. Traffic data are gathered as the traffic leaves and enters the US, and are routed to the NSA for analysis. [Source] [Source]

CA – Eavesdropping Agency’s Data Banks Go Unlisted despite Legal Obligation

The Defence Department appears to have broken the law by failing to publish the latest personal information listings of Canada’s electronic eavesdropping agency. Under federal privacy law, ministers are obliged to list the personal data banks — which hold information about individuals — compiled by agencies in their portfolios. However, there is no public listing this year for Communications Security Establishment Canada, known as CSEC, which reports to the defence minister. The omission has prompted University of Ottawa professor Amir Attaran to lodge a complaint with the federal privacy commissioner, who polices the federal law governing personal information. It’s important for CSEC “to be honest about what data it is gathering,” said Attaran, a lawyer who has taken a keen interest in Canadian information law. The personal data bank issue arises amid concerns about the sort of personal information CSEC and its close American ally, the National Security Agency, are collecting. CSEC spokesman Ryan Foreman said the spy service’s personal information banks used to be listed along with other Defence Department holdings in a federal publication called InfoSource, but in future will be cited separately, as CSEC is now a standalone agency. “CSEC is not exempted from the reporting requirements to publish an InfoSource submission. CSEC will be preparing its first independent InfoSource submission for the 2013-2014 reporting period,” Foreman said. “Previously published versions of InfoSource can be accessed through the Treasury Board Secretariat.” [Source] SEE ALSO: [Michael Geist on the perils of government surveillance] and [How to Tell if a Cell Phone Is Being Monitored]

UK – GCHQ Taps Fibre-Optic Cables for Secret Access to World Communications

Britain’s spy agency GCHQ has secretly gained access to the network of cables which carry the world’s phone calls and internet traffic and has started to process vast streams of sensitive personal information which it is sharing with its American partner, the National Security Agency (NSA). The sheer scale of the agency’s ambition is reflected in the titles of its two principal components: Mastering the Internet and Global Telecoms Exploitation, aimed at scooping up as much online and telephone traffic as possible. This is all being carried out without any form of public acknowledgement or debate. One key innovation has been GCHQ’s ability to tap into and store huge volumes of data drawn from fibre-optic cables for up to 30 days so that it can be sifted and analysed. That operation, codenamed Tempora, has been running for some 18 months. The existence of the programme has been disclosed in documents shown to the Guardian by the NSA whistleblower Edward Snowden as part of his attempt to expose what he has called “the largest programme of suspicionless surveillance in human history”. “It’s not just a US problem. The UK has a huge dog in this fight,” Snowden told the Guardian. “They [GCHQ] are worse than the US.” Britain’s technical capacity to tap into the cables that carry the world’s communications – referred to in the documents as special source exploitation – has made GCHQ an intelligence superpower. By 2010, two years after the project was first trialled, it was able to boast it had the “biggest internet access” of any member of the Five Eyes electronic eavesdropping alliance, comprising the US, UK, Canada, Australia and New Zealand. UK officials could also claim GCHQ “produces larger amounts of metadata than NSA”. By May last year 300 analysts from GCHQ, and 250 from the NSA, had been assigned to sift through the flood of data. The Americans were given guidelines for its use, but were told in legal briefings by GCHQ lawyers: “We have a light oversight regime compared with the US”. When it came to judging the necessity and proportionality of what they were allowed to look for, would-be American users were told it was “your call”. The Guardian understands that a total of 850,000 NSA employees and US private contractors with top secret clearance had access to GCHQ databases. The documents reveal that by last year GCHQ was handling 600m “telephone events” each day, had tapped more than 200 fibre-optic cables and was able to process data from at least 46 of them at a time. [The Guardian] [Source] [Source]

AU – Australian Government Shelves Metadata Collection Plan

The government has shelved a controversial plan to force Australian telecommunications companies, internet service providers and sites such as Facebook to collect “metadata” from Australian users and store it for two years. The government had run out of time to push the plan through before the election, but, after a powerful parliamentary committee raised concerns about it, the attorney general, Mark Dreyfus, confirmed more work was needed. “The government will not pursue a mandatory data retention regime at this time and will await further advice from the departments and relevant agencies and comprehensive consultation,” he said in a statement. [Source]

IN – India to Let Government Officials Access Private Phone Calls and Emails

India has launched a wide-ranging surveillance programme that will give its security agencies and even income tax officials the ability to tap directly into emails and phone calls without oversight by courts or parliament, several sources say. The expanded surveillance in the world’s most populous democracy, which the government says will help safeguard national security, has alarmed privacy advocates at a time when allegations of massive US digital snooping beyond American shores have set off a global furore. “If India doesn’t want to look like an authoritarian regime, it needs to be transparent about who will be authorised to collect data, what data will be collected, how it will be used, and how the right to privacy will be protected,” said Cynthia Wong, a researcher at New-York-based Human Rights Watch. The Central Monitoring System (CMS) was announced in 2011 but there has been no public debate and the government has said little about how it will work or how it will ensure that the system is not abused. The government started to quietly roll the system out state by state in April this year, according to government officials. Eventually it will be able to target any of India’s 900 million landline and mobile phone subscribers and 120 million internet users. [Source]

AU – Australia Building Data Storage Facility

The Australian government is building a data storage facility outside Canberra, the country’s capital, to allow intelligence agencies manage a “data deluge” from the Internet and telecommunications networks. The state-of-the-art facility will support Australia’s Defence Signals Directorate. Some of the information that Australian intelligence agencies receive comes from the US’s PRISM data gathering program. [Source] [Source]

CA – Privacy Commissioners Raise Concerns About Google Glass

Canada’s privacy commissioner and 36 of her counterparts in this country and around the world want to know how Google plans to protect people’s privacy when Google Glass hits the streets. “We would be very interested in hearing about the privacy implications of this new product and the steps you are taking to ensure that, as you move forward with Google Glass, individuals’ privacy rights are respected around the world,” reads an open letter to CEO Larry Page, signed by Jennifer Stoddart and provincial privacy commissioners, as well as those from Australia, Mexico, Switzerland, Israel and New Zealand. Almost from the moment Google announced its wearable computer goggles, privacy concerns were raised about the ability to record people surreptitiously and, in the blink of an eye, post it to the Internet. Among the questions in Tuesday’s letter: What information does Google collect via Glass and what information is shared with third parties, including application developers?; How does Google intend to use this information?; Is Google doing anything about the broader social and ethical issues raised by such a product? Their concerns echo those of the U.S. Congress, which in May sent a similar letter to Google about the “unanswered questions” around privacy. [Source] [CNET News]

Telecom / TV

US – FCC Rules Carriers Must Protect Data

The Federal Communications Commission (FCC) has ruled that telecoms need to safeguard consumer call information regardless of whether they’re using wireless or landlines. An FCC statement says, “When mobile carriers use their control of customers’ devices to collect information about customers’ use of the network…carriers are required to protect that information.” The ruling stems from an investigation into allegations that Carrier IQ was logging customers’ keystrokes. Commissioner Jessica Rosenworcel pointed out that the ruling applies only to carriers, adding, “They do not apply to the manufacturers of wireless phones. They do not apply to the developers of operating systems. Consumers can be confused by these distinctions.” [MediaPost]

WW – Almost Half of iPhone Apps Peek at Your Private Stuff

According to a new study, more than 13% of apps access an iPhone’s physical location while 6% access the device’s address book. Computer scientists at the University of California, San Diego discovered that nearly half of the mobile apps running on Apple’s iOS operating system have gained access to private data. These findings are based on a study of 130,000 users of jailbroken iOS devices, where uses have removed restrictions that keep apps from accessing the iPhone’s operating system. One might assume that the results are skewed because the study participants were using a jailbroken iPhone. However, the majority of applications in the study were downloaded through Apple’s App Store and were able to access the same information on locked phones as well. In March, Apple stopped accepting new applications or app updates that access these “unique identifiers,” or privacy invaders. However, the findings suggest that although this update was made to the App Store policy, many apps can still get that information. Unique identifiers allow the creators of the app and advertisers to track a user’s behavior through all the different apps on their devices. Some apps even associate the unique identifier with the user’s email and other personal information. The researchers developed an app called ProtectMyPrivacy (PMP) that is able to detect what data the other apps running on an iOS device are trying to access. Their application enables users to selectively allow or deny access to information on an app-by-app basis, based on whether they feel the apps need the information to function properly. The team has also added notifications and recommendations for when an app accesses other privacy-sensitive information, such as a devices’ front and back camera, microphone and photos. “We wanted to empower users to take control of their privacy,” said Yuvraj Agarwal, a research scientist in the Department of Computer Science and Engineering at UC San Diego who co-authored the study. “The choice should be in users’ hands.” Nearly all of PMP’s users voluntarily shared their privacy decisions, allowing the researchers to see which apps they believe should be allowed access to their privacy-sensitive data. PMP is able to make recommendations for 97% of the 10,000 most popular iPhone apps. [Source]

WW – Security Flaws in Phone App Library

Vulnerabilities in the GNU ZRTPCPP open-source security library used by some secure mobile phone apps could be exploited to allow arbitrary code execution and crash applications. The flaws include a remote heap overflow, several stack overflows, and information leakage. [ComputerWorld] [The Register

US Government Programs

US – US Administrative Office of the Courts’ 2012 Wiretap Report

The US Administrative Office of the Courts 2012 Wiretap Report notes that 15 wiretaps last year encountered encrypted communications. In previous years, there have been a total of seven other instances. In four of the cases, officials were not able to decrypt the messages. This is the first time that officials have reported being thwarted by encryption “since the AO began collecting encryption data in 2001.” According to the report, there were 3,395 authorized wiretaps from state or federal judges in 2012. The numbers do not include “interceptions regulated by the Foreign Intelligence Surveillance Act of 1978.” [WIRED] [US Courts]

US Legislation

US – Bill Proposed To Strengthen Oversight of FISA, USA PATRIOT Act

Sen. Patrick Leahy (D-VT), with the co-sponsorship of Sens. Lee (R-UT), Udall (D-CO), Wyden (D-OR), Blumenthal (D-NY) and Tester (D-MT), proposed the FISA Accountability and Privacy Protection Act of 2013 to “strengthen privacy protections, accountability and oversight related to domestic surveillance conducted pursuant to the USA PATRIOT Act and the Foreign Intelligence Surveillance Act of 1978.” Privacy Tracker reports on the proposed changes, including allowing challenges to gag orders in court, expanding public reporting of national security letters and requiring a comprehensive review of the FISA Amendments Act by the inspector general of the intelligence community. [IDG News]

US – Federal Baseline Breach Notification Bill Introduced

Sen. Pat Toomey (R-PA) introduced legislation Thursday to mandate a nationwide standard for data breach notification. Sponsored by Sens. Angus King (I-ME) and John Thune (R-SD), the bill would preempt the current slate of 46 state breach notification laws and provide “better protections and swifter responses for consumers.” With a combination of high-profile data breaches and varying state mandates, “Congress needs to provide businesses and consumers with certainty and establish a single reasonable standard for information security and breach notification practices,” the press release states. [Toomey press release]

US – Louisiana Governor Passes Gun-Owner Protection Law

Louisiana Governor Bobby Jindal signed a bill last week that he says protects the privacy rights of law-abiding gun owners. The law imposes fines of up to $10,000 and jail sentences of up to six months on those that publish the names of people who own or have applied for a concealed handgun permit. “The law raises the constitutional question of prior restraint, meaning when the government prohibits speech or other expression before it can take place” [Source] Rep. Jeff Thompson (R-Bossier City) said the bill was a response to the controversial map published last year in a New York paper including the names and addresses of handgun permit-holders within its readership region. According to the reports, Arkansas (SB 131), Maine (LD 345), Mississippi (HB 485), New York (New York Secure Ammunition and Firearms Enforcement Act) and Virginia (SB 1335) have all passed laws to protect the identities of concealed weapons permit-holders.

US – Student Privacy Bill Proposed in Massachusetts

Massachusetts Lawmakers are considering Bill H 331 to prohibit those providers that deliver cloud computing services to kindergarten through grade-12 schools from processing student data for commercial purposes. The bill was filed by Rep. Carlo Basile (D-East Boston) and is a pressing issue as the state is one of five considering participation in inBloom, a Gates Foundation pilot program that aims to help schools simplify computer systems. Rep. Alice Peisch (D-Wellesley) questioned why FERPA doesn’t address the problem; The Lowell Sun pointed to criticisms that 2011 changes to FERPA opened the door for schools to share student data with private entities.

US – New Jersey Senate Passes Drone Regs

Last week, the New Jersey Senate unanimously passed S2702, a bill that sets guidelines for state officials’ use of drones. Permitted uses include criminal investigations and events that “substantially endanger the health, safety and property of the citizens;” however, the use would need to be approved by the agency chief, reports New Jersey.com. The bill also restricts use of both audio and visual recording taken by drones. The bill has been received by the Assembly and referred to the Assembly Homeland Security and State Preparedness Committee.

US – Oregon Drone Bill Heads to Governor

Oregon’s police drone bill (SB 71) passed the House 56-3 last week and is headed to the governor’s desk. If signed into law, the bill would bar law enforcement from using drones to collect information without a warrant, except in specified situations.

US – Texas Broadens Breach Notification Law

While Texas has had a breach notification law on the books for a while now that applies to citizens of states without a notification law, it recently passed Senate Bill 1610, which increases the scope further. The new law applies to everyone affected by a breach—regardless of the law in their state of residence; gives organizations the choice of reporting under Texas law or that of the state of the affected person, and allows written notification to go to the last known address. This law differs from many other state breach laws in its perspective. “While most state laws apply when its residents have been affected by a breach, Texas law applies to persons dealing with personal information who conduct business in Texas,” adding that no matter what the new law requires, “best practice will remain notifying under the law of the state where the affected party resides.” [Source]

US – Nevada Social Media Law Has Broad Scope

Nevada has become the 11th state to pass an employee social media law. Effective October 1, employers may not ask employees or prospective employees for information that would provide access to their social media accounts. Nor are employers allowed to fire, discipline or discriminate in any way against employees or prospective employees who do not share that information with them. One point to note is that the Nevada law defines social media broadly as “any electronic service or account or electronic content, including, without limitation, videos, photographs, blogs, video blogs, podcasts, instant and text messages, electronic mail programs or services, online services or Internet website profiles,” essentially saying it applies to any online account. So, while the law’s restrictions are narrower than many similar laws, the scope is broader. Nevada joins Arkansas, California, Colorado, Illinois, Maryland, Michigan, New Mexico, Oregon, Utah and Washington in passing a social media law. [Source]

Workplace Privacy

WW – If Nine Of 10 Employees Breach Policies, How Is Privacy Possible?

A survey taken over several years has found that out of 165,000 employees surveyed, 93 percent knowingly violate policies designed to prevent data breaches. Privacy professionals burn the midnight oil crafting policies in line with best practices. But such policies don’t stand a chance at protecting consumer data if the employees charged with practicing model data-steward behavior could care less about doing so. So how can a company ensure that its people are complying with the policies it promises to practice? [The Privacy Advisor] [Financial Times]

CA – Supreme Court Says No to Random Alcohol Testing

The Supreme Court late last week ruled that companies cannot institute mandatory random alcohol testing of employees. “Random alcohol testing is a humiliating invasion of an individual’s privacy that has no proven impact on workplace safety,” said Dave Coles, president of the Communications, Energy and Paper Workers Union of Canada. Communications, Energy and Paperworkers Union of Canada, Local 30 vs. Irving Pulp & Paper, Limited stems from a 2006 policy by Irving that chose an employee randomly by a computer program. The employee showed a zero blood alcohol level but claimed the test was humiliating and unfair. [Source]

+++