======================================================================== E P I C A l e r t ======================================================================== Volume 13.19 September 22, 2006 ------------------------------------------------------------------------ Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org/alert/EPIC_Alert_13.19.html ======================================================================== Table of Contents ======================================================================== (1) Voting ID Requirements Struck in Missouri (2) Privacy and Security Flaws Imperil Transit Worker ID Program (3) International Consumer Groups Urge US, EU to Protect Passenger Data (4) EPIC Urges US to Stop Surveillance Tech Exports (5) DC Residents Speak Up for Crime Prevention (6) News in Brief (7) EPIC Bookstore: "Privacy, Information, and Technology" (8) Upcoming Conferences and Events ======================================================================== (1) Voting ID Requirements Struck in Missouri ======================================================================== On September 14, a Missouri trial court struck down a state law requiring voters to present a government-issued photo ID at the polls. Judge Richard Callahan of Cole County Circuit Court found that the law violated the Missouri constitution, since it denied the right to vote to those who Citizens of the state had challenged the new law, arguing that its restrictions denied the right to vote to those who could not afford to obtain such IDs. In 2005, when the state expanded the number of documents required to obtain a drivers license or ID card. The 2005 law required applicants to prove lawful presence, identity, and residence. Although the state did not charge for ID cards themselves, applicants for an ID must spend money on documents required to obtain the ID. Lawful presence, for example, could be established with a US passport ($97-$236) or a birth certificate with an embossed or raised seal by the issuing state or municipality ($15-$30). For citizens born abroad, the cost for voting would have been even greater. The court also noted that there had been no complaints of voter fraud under the previous voting law, which did not require a government-issued photo ID. Two other states have addressed voter ID requirements in recent weeks. On September 19, Georgia's third attempt at a voter photo ID requirement for the state's special election was also declared unconstitutional by a federal court judge. A federal judge in Arizona, however, allowed a state ID requirement to stand one day before its first use during a statewide primary election. On September 11, U.S. District Judge Roslyn O. Silver refused to halt enforcement of the new law's application, requesting additional briefs and scheduling a hearing for October 19, but without providing the reasoning for her decision. Arizona's new law, enacted as a result of a ballot initiative in 2004, imposes proof of citizenship requirements on voters both during the registration process and on Election Day. According to the National Conference of State Legislatures, 24 states have some form of ID requirement, while only seven require a photo ID. This list does not include the state of Georgia, due to the court decisions earlier this year. Some federal lawmakers are pressing for similar requirements, however. The US House of Representatives passed H.R. 4844, the Federal Election Integrity Actby a vote of 228 to 196. This bill would require voters to prove their citizenship and present photo ID prior to voting in any federal election. The bill contains no funding nor provisions for those who might due to religious beliefs oppose photo ID documents. Currently there is no document recognized as providing proof of citizenship. Ruling in Missouri Case, Weinschenk v. Missouri (pdf): http://www.epic.org/privacy/voting/pdf_files/Misri_vot2.pdf Complaint in Weinschenk v. Missouri (pdf): http://www.epic.org/privacy/voting/pdf_files/Misri_vot3.pdf EPIC's Voting Page: http://www.epic.org/privacy/voting ======================================================================== (2) Privacy and Security Flaws Imperil Transit Worker ID Program ======================================================================== Security and privacy problems have delayed the implementation of the Transportation Worker Identification Credential program. TWIC is a Homeland Security program designed to screen the backgrounds of and issue biometric ID cards to the nation's 750,000 air, land and sea transportation workers. TWIC was created in November 2002 as part of maritime security legislation, but the pilot program was delayed for two years. In that time, its cost has nearly doubled from $12 million to $23 million, even though only 4,000 of the planned 200,000 cards were issued through a pilot program. Under TWIC, Homeland Security would gather finger scans, iris scans, digital photographs and detailed biographical, employment and other personal data from those hoping to work in the transportation industry. The applicants' names would then be run against immigration and terror watch lists. EPIC has previously reported about the mistakes and problems associated with terror watch lists. Often innocent people are on or have similar names to those on the lists, and it is difficult to correct the lists. Sen. Ted Kennedy was matched to a name on the list, and he could only resolve the problem with the help of then-Homeland Security Secretary Tom Ridge. The lists are also bloated -- they were revealed to include 325,000 names. The Inspector General for the Department of Homeland Security released a report in July titled "DHS Must Address Significant Security Vulnerabilities Prior To TWIC Implementation." The report said, "Due to the number and significance of the weaknesses identified, TWIC prototype systems are vulnerable to various internal and external security threats." The security problems must be rectified because they "may threaten the confidentiality, integrity, and availability of sensitive TWIC data," the report said. Homeland Security has postponed the installation of TWIC card readers. It is not known when or if the program will be fully implemented. TSA's page on TWIC: http://www.tsa.gov/what_we_do/layers/twic/index.shtm DHS Inspector General Report on TWIC (Redacted) (pdf): http://www.epic.org/redirect/dhs_ig_twic.html EPIC's Biometric Identifiers page: http://www.epic.org/privacy/biometrics/ EPIC's National ID Cards and REAL ID Act page: http://www.epic.org/privacy/id_cards/ ======================================================================== (3) International Consumer Groups Urge US, EU to Protect Passenger Data ======================================================================== The Transatlantic Consumer Dialogue (TACD), a coalition of US and EU consumer groups, wrote to US and EU officials, urging them to include privacy safeguards into air passenger data sharing agreements. Officials in the US and EU are currently discussing the international sharing of passenger name records (PNRs) between the travel industry and law enforcement. United States Homeland Security Secretary Michael Chertoff is seeking to expand the data that is available to US agencies, and to share the data with more US agencies. PNRs, are data held by air carriers and travel agents collected during booking. They can include passenger travel dates, home and work addresses, payment details, members of party, meal preferences (such as whether a passenger requires halal or kosher meals), and more. However, the minimum amount required for a travel booking is a name, contact information, and itinerary. PNRs have been shared with the US under an agreement that was held to be invalid in by a May 2006 European Court of Justice decision. That decision held that the data sharing agreement violated the privacy of European air travelers, a violation of the 1995 EU directive on data protection. The court ruled that the agreement must be renegotiated with proper protections and legal basis or it would be annulled by September 30, 2006. The consumer groups request that officials considering PNR sharing abide by three criteria. First, the agreement must respect the May 2006 European Court of Justice decision that PNR sharing agreements must have an adequate legal basis and be respectful of US and EU privacy laws. Second, the US and EU must conduct a study comparing the effectiveness of passenger profiling with other safety techniques. Third, the groups held that an annual report of PNR sharing must be published. Text of TACD letter: http://www.epic.org/redirect/tacd_pnr_letter.html Wikipedia Entry on Passenger Name Records: http://en.wikipedia.org/wiki/Passenger_Name_Record EPIC's page on Passenger Name Records http://www.epic.org/privacy/intl/passenger_data.html ======================================================================== (4) EPIC Urges US to Stop Surveillance Tech Exports ======================================================================== In a letter addressed to the Secretary of Commerce Carlos Gutierrez, EPIC urged the Department of Commerce to restrict the export of high-tech surveillance equipment to China. While the US has restricted the export of products such as tear gas, handcuffs, and shotguns to China, the letter noted, high-tech equipment that can be used for surveillance and censorship is freely exported to the country. The export restrictions were put in place following the 1989 Tienanmen Square massacre. Recent reports on human rights abuses in China have focused on the role that US technology companies have played in the suppression of free speech. A recent article in BusinessWeek, for example, highlighted the fact that Oracle, Cisco, Motorola, and EMC Corp. all sold technology products to Chinese police and security authorities that can be used to track political dissidents, in spite of China's "dismal" human rights record. EPIC's letter highlighted portions of this track record indicating that surveillance and censorship technology plays a major role in human rights abuses. For instance, the US State Department's 2005 report on human rights in China states, "During the year authorities monitored telephone conversations, facsimile transmissions, e-mail, text messaging, and Internet communications...The security services routinely monitored and entered residences and offices to gain access to computers, telephones, and fax machines." The technology that allows this surveillance and tracking, said EPIC, was often provided by companies based in the United States. Cisco, for example, has marketed and sold its products as "strengthening police control." In hearings conducted in February, members of the House Subcommittee on Human Rights condemned a number of US companies for their role in suppressing free speech and dissent in China. The company representatives said that they were abiding by Chinese law, and asked the US government, including the Department of Commerce, to also take a strong stand against human rights abuses. EPIC's letter stressed this need for leadership from the US government: "The American democratic tradition, and its worldwide reputation of valuing democracy and individual freedoms could be undermined by the involvement of the US technology industryŠCompanies need to be presented with a strong legislative framework in which to carry out their trade with Chinese customers." EPIC's Letter to Secretary Gutierrez (pdf): http://www.epic.org/privacy/intl/doc_china_letter.pdf BusinessWeek Article: http://www.businessweek.com/magazine/content/06_38/b4001067.htm House Human Rights Subcommittee, Hearing Notice: The Internet in China: http://wwwc.house.gov/international_relations/109/af021506.htm ======================================================================== (5) DC Residents Speak Up for Crime Prevention ======================================================================== Washington, DC, residents and a coalition of groups, including EPIC, the ACLU, DC Action for Children, and Efforts for Ex-Cons, gathered Monday night to discuss crime prevention measures. Topics included community policing, curfews, rehabilitation of ex-offenders, and surveillance cameras. Johnny Barnes, Executive Director of the ACLU-National Capital Area, welcomed the crowd and explained that the gathering was in response to "emergency crime legislation" that the DC Council hastily enacted in response to several high profile crimes. The emergency legislation more than doubled the number of cameras in the district, created an earlier curfew and expanded police access to confidential juvenile information. Ron Hampton, Executive Director of the National Black Police Association and a self-described "former beat cop" explained the many ways that effective community policing helps cut crime rates. When the police have the resources to devote to learning about the people and places in their neighborhood beats, they are better able to help the community with crime reduction and prevention, he said. Such community policing would reduce the fear of crime and improve relations between the police and citizens, he said. Melissa Ngo, Director of EPIC's Identification and Surveillance Project, and Jay Stanley, Public Education Director of the Technology and Liberty Program at the ACLU, discussed the problems with surveillance cameras. Constant surveillance, Stanley said, creates a chilling effect on free speech when people learn that their peaceful, legal protests are being watched and recorded. Stanley also pointed out that the cities of Detroit, Miami, and Oakland all abandoned their camera surveillance systems because they were ineffective in reducing crime. Studies have also shown that it is more effective to place more officers on the streets and improve lighting in high-crime areas than to use surveillance cameras, he said. Ngo said the cameras are invasive and just don't work. Furthermore, she said, funds spent on cameras could be spent on more effective crime-fighting tools. The emergency legislation allotted $2.3 million for the city to buy 23 cameras to add to the 19 cameras in the District, but Ngo said the $2.3 million could have been put to better use by hiring an additional 46 police officers, at a salary of $50,000. After the expert presentations, there was a question and answer period with the audience. The DC Council's Committee on Consumer and Regulatory Affairs will hold a public hearing on PR 16-766 "Metropolitan Police Department Closed Circuit Television Regulations Amendment Approval Resolution of 2006" on Oct. 4, 2006 in Room 412 of the John A. Wilson Building at 1350 Pennsylvania Ave. NW, Washington, DC. D.C. Council Home Page: http://www.dccouncil.washington.dc.us/ American Civil Liberties Union-National Capital Area: http://www.aclu-nca.org/ National Black Police Association: http://www.blackpolice.org/ EPIC's Comments to the D.C. Council on the April CCTV proposal (pdf): http://www.epic.org/privacy/surveillance/cctvcom062906.pdf EPIC's Video Surveillance page: http://www.epic.org/privacy/surveillance/ ======================================================================== (6) News in Brief ======================================================================== EU Data Supervisor: Privacy, Security Not Opposed On September 18, Peter Hustinx, the European Data Protection Supervisor, emphasized the importance of personal privacy in ensuring national security. "It is a misconception that protection of privacy and personal data holds back the fight against terrorism and organised crime. . . Good data protection actually goes hand in hand with legitimate crime fighting because it increases the quality of data bases and at the same time makes sure that only the right people can access them," he said. Hustinx stated that existing laws and legal processes allowed for law enforcement access to important information on criminals and terrorists, and that any new systems allowing access to personal information needed to have adequate checks and safeguards to protect personal privacy. Press Release from the European Data Protection Supervisor: http://www.epic.org/redirect/hustinx_statement.html Social Networking Site Pays $1 Million for Privacy Violations Xanga.com, a social networking site, agreed to pay $1 million for violating the Children's Online Privacy Protection Act. The Federal Trade Commission brought the action against the website after Xanga collected, used, and disclosed information about children under the age of 13 without first notifying parents and obtaining their consent. Although Xanga's policies stated that users had to be over 13 to join, it allowed users to register on the site even after they provided a birth date indicating they were under 13 years old. The consent order not only includes the $1 million penalty, but also requires that Xanga delete all of the information collected on underage children. FTC Press Release: http://www.ftc.gov/opa/2006/09/xanga.htm Text of the Consent Decree (pdf): http://www.ftc.gov/os/caselist/0623073/xangaconsentdecree.pdf British Protest Covert Trash-Monitoring Chips Homeowners in Britain are protesting the recent installation of electronic chips in their outdoor trash cans. The chips measure the weight of trash placed in the cans and transmit that information to a central database. British officials have said the information could be used to fine residents who are not recycling enough. Homeowners have been removing the monitoring chips from their cans and sending them to city council members with angry letters. City councils are responding with threats of fines for damaging city property. Coverage of the Protests in the Daily Mail: http://www.epic.org/redirect/trash_chip_story.html US Should Limit SSN Use, Task Force Says The President's Identity Theft Task Force issued its interim recommendations for combating identity theft, which the Federal Trade Commission has called the fastest growing crime in the nation. Among the recommendations was that the government limit government use of the Social Security number as an identifier. Because Social Security numbers are frequently used for authentication in the private sector, their disclosure can easily lead to identity theft. The Task Force also recommended that government agencies implement contingency plans in case there is a breach of individuals' personal information. However, these recommendations leave it to the heads of the agency to decide whether or not to reveal the breach to those affected. Interim Recommendations of the Task Force (pdf): http://www.ftc.gov/os/2006/09/060916interimrecommend.pdf EPIC's SSN Privacy Page: http://www.epic.org/privacy/ssn/ States Oppose Preemption on Wireless Law Forty-one state Attorneys General wrote to Congress, opposing provisions of H.R. 5252, the "Advanced Telecommunications and Opportunity Reform Act." These provisions of the telecommunications bill would override state laws that regulate wireless telecommunications services and voice over Internet Protocol (VoIP) services. The attorneys general argue in the letter that preemption of state laws would harm consumers by denying them state protections against unfair and fraudulent trade practices by certain telecommunications and VoIP providers. State governments have often acted more swiftly and thoroughly to protect privacy rights, only to have protections rolled back by federal preemption. Letter from 41 State Attorneys General (pdf): http://www.naag.org/news/pdf/20060915.WirelessPreemption.pdf EPIC's Privacy and Preemption Page: http://www.epic.org/privacy/preemption/ ======================================================================== (7) EPIC Bookstore: "Privacy, Information, and Technology" ======================================================================== "Privacy, Information, and Technology" by Daniel J. Solove, Marc Rotenberg, and Paul Schwarz (Aspen Publishers 2006). http://www.powells.com/partner/24075/biblio/62-0735562458-1 "This short paperback, developed from the casebook, 'Information Privacy Law,' contains key cases and materials focusing on privacy issues related to information technology, databases, and cyberspace. Topics covered include government surveillance, privacy and access to public records, government access to personal information, data mining, identity theft, consumer privacy, financial privacy, and more." ================================ EPIC Publications: "Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98. http://www.epic.org/redirect/aspen_ipl_casebook.html This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law. ================================ "Privacy & Human Rights 2005: An International Survey of Privacy Laws and Developments" (EPIC 2006). Price: $60. http://www.epic.org/bookstore/phr2005/phr2005.html This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 70 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2005 is the most comprehensive report on privacy and data protection ever published. ================================ "FOIA 2004: Litigation Under the Federal Open Government Laws," Harry Hammitt, David Sobel and Tiffany Stedman, editors (EPIC 2004). Price: $40. http://www.epic.org/bookstore/foia2004 This is the standard reference work covering all aspects of the Freedom of Information Act, the Privacy Act, the Government in the Sunshine Act, and the Federal Advisory Committee Act. The 22nd edition fully updates the manual that lawyers, journalists and researchers have relied on for more than 25 years. For those who litigate open government cases (or need to learn how to litigate them), this is an essential reference manual. ================================ "The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40. http://www.epic.org/bookstore/pvsourcebook This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process. ================================ "The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40. http://www.epic.org/bookstore/pls2004/ The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act. ================================ "Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20. http://www.epic.org/bookstore/filters2.0 A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression. ================================ EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at: EPIC Bookstore http://www.epic.org/bookstore "EPIC Bookshelf" at Powell's Books http://www.powells.com/features/epic/epic.html ================================ EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act. Subscribe to EPIC FOIA Notes at: https://mailman.epic.org/cgi-bin/control/foia_notes ======================================================================== (8) Upcoming Conferences and Events ======================================================================== Preventing and Responding to Security Breaches. Privacy Journal. September 28-29. New York, New York. For more information: www.aciresources.com Identity and Identification in a Networked World. New York University. September 29-30, 2006. New York, New York. For more information: http://www.easst.net/node/976 34th Research Conference on Communication, Information, and Internet Policy. Telecommunications Policy Research Conference. September 29-October 1, 2006. Arlington, Virginia. For more information: http://www.tprc.org/TPRC06/2006.htm 6th Annual Future of Music Policy Summit. Future of Music Coalition. October 5-7, 2006. Montreal, Canada. For more information: http://www.futureofmusic.org/events/summit06/ The IAPP Privacy Academy 2006. International Association of Privacy Professionals. October 18-20, 2006. Toronto, Ontario, Canada. For more information: http://www.privacyassociation.org International Conference on Privacy, Security, and Trust (PST 2006). University of Ontario Institute of Technology. October 20-November 1, 2006. Markham, Ontario, Canada. For more information: http://www.businessandit.uoit.ca/pst2006/ Internet Governance Forum (IGF) October 30-November 2, 2006. Athens, Greece. For more information: http://www.igfgreece2006.gr/ 28th International Data Protection and Privacy Commissioners' Conference. November 2-3, 2006. London, United Kingdom. For more information: http://www.privacyconference2006.co.uk/ BSR 2006 Annual Conference. Business for Social Responsibility. November 7-10, 2006. New York, New York. For more information: http://www.bsr.org/BSRConferences/index.cfm 5th Conference on Privacy and Public Access to Court Records. Center for Legal and Court Technology and Administrative Office of the United States Courts. March 22-23, 2007. Williamsburg, Virginia. For more information: http://www.courtaccess.org/ CFP2007: Computers, Freedom, and Privacy Conference. Association for Computing Machinery. May 2007. Montreal, Canada. For more information: http://www.cfp2007.org. ====================================================================== Subscription Information ====================================================================== Subscribe/unsubscribe via web interface: https://mailman.epic.org/cgi-bin/mailman/listinfo/epic_news Back issues are available at: http://www.epic.org/alert The EPIC Alert displays best in a fixed-width font, such as Courier. ======================================================================== Privacy Policy ======================================================================== The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name. In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information." ======================================================================== About EPIC ======================================================================== The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at: http://www.epic.org/donate Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers. Thank you for your support. ------------------------- END EPIC Alert 13.19 ------------------------- ================== HURIDOCS-Tech listserv ===================== Send mail intended for the list to < >. Archives of the list can be found at: http://www.hrea.org/lists/huridocs-tech/markup/maillist.php
[Reply to this message] [Start a new topic] [Date Index] [Thread Index] [Author Index] [Subject Index] [List Home Page] [HREA Home Page]