ghosts in the machine

Lessons from the Identity Trail

2009-04-27T10:29:00.000-07:00

"One uploaded photo, credit card number or status update at a time, we are relinquishing our privacy and anonymity." That's according to the results of a study on how society's use of information communication technologies impacts privacy and anonymity. University of Ottawa professor Ian Kerr and nearly two dozen researchers from across the globe spent four years examining the issue, ultimately determining that our anonymity and right to privacy is in jeopardy.

The results of their research have been published in a book, On the Identity Trail: Anonymity, Privacy and Identity in a Networked Society, which is available for free download online. Kerr also provides an overview in this CBC podcast, which aired on April 17, 2009.

Among the findings:

The researchers reported that governments are choosing laws that require people to identify themselves and are lowering judicial thresholds defining when identity information must be disclosed to law enforcement officials. That is allowing the wider use of new technologies capable of making people identifiable, including smartcards, security cameras, GPS, tracking cookies and DNA sequencing.

Consequently, governments and corporations are able to do things like:

Embrace technologies such as radio frequency identification tags that can be used to track people and merchandise to analyze behaviour.
Boost video surveillance in public places.
Pressure companies such as internet service providers to collect and maintain records of identification information about their customers.

While Canada, the U.K., the Netherlands and Italy all have national laws protecting privacy – that is, laws that allow citizens to control access to their personal data – such legal protection does not exist for anonymity.

Ontario's Privacy Commissioner on RFID & EDLs: Podcast

2009-03-11T10:18:00.000-07:00

This week's CBC "Search Engine" podcast explores the use of RFID technology in Canadian driver's licenses. Ontario Privacy Commissioner Ann Cavoukian shares her privacy concerns about enhanced drivers' licenses (EDLs) and discusses ways citizens who choose to use EDLs could protect their personal information from RFID skimmers when the cards are not in use. She emphasizes that use of EDLs is voluntary and expects on-off switch technology for the IDs to be ready in 2010.

Enhanced driver's licenses have been developed as a passport alternative for use when crossing the U.S. border. They are already in use in Manitoba and are set to launch in Ontario this June.

Project Eyeborg: "Bionic" Journalist Rob Spence

2009-03-05T20:12:00.000-08:00

Rob Spence, a Canadian filmmaker who lost an eye in an accident as a teenager, plans to have a mini camera installed in his prosthetic eye to make documentaries and raise awareness about surveillance in society.

For Project Eyeborg, Spence will have a camera, a battery and a wireless transmitter mounted on a tiny circuit board in his prosthetic eye, but no part of the camera would be connected to his nerves or his brain.

"In Toronto there are 12,000 cameras. But the strange thing I discovered was that people don't care about the surveillance cameras, they were more concerned about me and my secret camera eye because they feel that is a worse invasion of their privacy."

Spence, whose last film "Let's All Hate Toronto" explored the Canada-wide trend of hating that city, has no plans to make reality programming. The focus of his latest film is surveillance and the eye project has become central to the film.

The filmmaker has been working with a team of engineers to build a prototype in time for this week's 2009 “Digital News Affairs (DNA) conference.

Vancouver Olympics security raises privacy concerns

2009-02-12T11:34:00.000-08:00

While the Vancouver 2010 Olympics have come under criticism for rapidly inflating costs, federal privacy commissioner Jennifer Stoddart is sounding the alarm about security plans for the winter event.

“Experience has shown that Olympic Games and other mega-events can leave a troubling legacy – large-scale, security surveillance systems installed for mega-events often remain long after the event is over,” she says. What happened following the Athens Games of 2004 is a case in point. Closed-circuit cameras installed for the Games were left in place afterwards to help law enforcement monitor citizens, notably during public demonstrations.

British Columbia’s privacy commissioner, David Loukadelis said last year that he had been assured by the RCMP the images from those cameras will be available only to key people. While using extraordinary measures to keep diplomats and athletes safe is reasonable for a special event he is concerned that once the Games are over, those cameras might remain and become a unreasonable infringement on everyday privacy rights.

Just as in Athens, following the Olympics in Sydney, many closed-circuit TV cameras were left in place after the Games.

Both Stoddart and Loukadelis have discussed security and privacy issues for the Games and will collaborate in monitoring security measures and privacy protections, in order to ensure that privacy rights are fully respected during the Games and after.

PEW Internet Study: Online Generation Gap Narrowing

2009-01-30T17:51:00.001-08:00

The PEW Internet and American Life project released a report this week on Generations Online in 2009. The study shows that while over half of the adult internet population is between 18 and 44 years old, larger percentages of older generations are online now than in the past, and they are doing more activities online, according to surveys taken from 2006-2008.

Contrary to the image of Generation Y (born between 1977-1990) as the "Net Generation," internet users in their 20s do not dominate every aspect of online life.

Among the key findings:

Generation X (born 1965-1976), is the most likely group to bank, shop, and look for health information online.
Boomers (born 1946 - 1964) are just as likely as Generation Y to make travel reservations online.
Silent Generation internet users (born 1937-1945) are competitive when it comes to email (although teens might point out that this is proof that email is for old people).

The most dramatic increase in internet use can be seen in the 70-75 year-old age group. While just over one-fourth (26%) of 70-75 year olds were online in 2005, 45% of that age group is currently online.

Photo by: max_thinks_sees

Data Privacy Day 2009: Raising awareness

2009-01-27T20:02:00.000-08:00

January 28th marks the 2nd annual international data privacy day in Canada, the U.S. and 27 European countries. The purpose of the event is to "raise awareness and generate discussion about data privacy practices and rights." It also serves the important purpose of furthering international collaboration and cooperation around privacy issues.

This year's data privacy day comes on the heels of what may have been the largest breach ever reported, with the personal information of nearly 100 million exposed at a U.S.-based credit card processing firm. Hackers breached the computer network at Heartland Payment Systems Inc., exposing customers' credit card numbers, card expiration dates and some internal bank codes - all information that could be used to forge a credit card. The company handles 100 million card transactions for 250,000 businesses nationwide each month.

The scale of the breach is “shocking,” says Jennifer Stoddart, Privacy Commissioner of Canada.

“After what we saw at TJX, that you could have such a major data breach, I'm asking myself what is happening and what is not getting through to organizations?” she says. “You should always take the steps to make sure there is suitable protection.”

As this most recent breach demonstrates, there is still much work to be done to raise awareness about data privacy.

CCTV is not the best way to combat crime

2008-11-08T21:45:00.000-08:00

British Columbia’s provincial government is planning to spend one million dollars on a pilot CCTV project to help combat crime in Vancouver, Kelowna and Surrey.

According to the province’s Solicitor General, John van Dongen:

Technologies such as CCTV can greatly assist the police and the prosecution in bringing offenders to justice. We believe CCTV can be an important tool in catching criminals and improving public safety.

If we look at the results of CCTV use in the U.K., van Dongen is vastly over-stating its effectiveness. The U.K. began experimenting with CCTV in the 1970’s and its use has grown to more than 4 million cameras across the UK, or at least one for every 14 people. In 2002, it was estimated that the average London resident was captured on camera about 300 times per day. Since the mid-1990’s billions of pounds have been spent on CCTV technology in the UK.

Yet, despite all this, a recent report from New Scotland Yard indicated that only about 3% of crimes were solved by the use of CCTV. Furthermore, a report by the Home Office in 2002, which reviewed 18 other studies on the effectiveness of CCTV, found just a 4% overall reduction in crime when CCTV cameras were used.

Given these results, the evidence tells us that the return on investment with CCTV is far too low to warrant the expense. One study indicates that there would have been a greater reduction in crime if those billions of pounds had been spent on more cops walking the beat. Jonathan Klick, a law professor at Florida State University, and Alexander Tabarrok of George Mason University, studied the increased police presence in key areas of Washington D.C. during high terror alert days and found a 15 percent reduction in crime.

The added and less quantifiable cost of CCTV is the loss of privacy to citizens and the negative impact on civil liberties. B.C.’s Solicitor General said he intended to work with the province’s Information and Privacy Commissioner “to establish clear rules for the collection, management and protection of information from the cameras.” However, Privacy Commissioner David Loukidelis said he learned about the program a mere fifteen minutes before the news conference announcing the CCTV pilot project.

BC residents and politicians who are concerned about crime and public safety should advocate for more police officers, community policing programs and proven crime prevention measures (such as improved lighting) instead of throwing away millions in tax dollars in the creation of a surveillance society.

Smile, You're on Candid Camera

Cops Want Covert Cameras in Public Places

Homeland Security's Chertoff: more surveillance, less privacy

PIPEDA: Guidelines for Covert Video Surveillance

2008-10-25T21:18:00.000-07:00

A manager at a railway company uses the zoom lens on cameras, installed for the purpose of monitoring train movements, to watch two employees leaving company property during regular working hours without permission.

An employee with a history of work-related injuries over a period of several years refuses to cooperate with his employer’s efforts to accommodate him or to provide current information to support his disability claim. His employer hires a private investigation firm to conduct covert video surveillance to observe the employee for a period of two weeks to determine if he indeed had the physical limitations he was claiming.

A transportation company hires a private investigation firm to conduct surveillance on an employee suspected of violating the company’s Conflict of Interest Policy by having a romantic relationship with a colleague. While the employee under investigation was the target of the surveillance, images were also covertly captured of the colleague and alleged romantic partner.

Which of the above scenarios are in violation of PIPEDA (Personal Information Protection and Electronic Documents Act)? *

The Privacy Commissioner of Canada has prepared a draft guidance document that sets out good practice rules for private sector organizations that are either contemplating or using covert video surveillance.

The guidelines also include the test used by the Office of the Privacy Commissioner to determine whether an organization may properly rely on covert video surveillance:

1. The collection of personal information must only be for purposes that a reasonable person would consider appropriate in the circumstances.

2. There should be substantial evidence to support the suspicion that:

the relationship of trust between the organization and an individual has been broken;

there has been a breach of an agreement; or,

a law has been contravened.

3. Covert surveillance is a last resort and should only be contemplated if all other less privacy-invasive means of collecting personal information have been exhausted.

4. The collection of personal information must be limited to the stated purposes to the greatest extent possible.

Feedback on the draft guidance will be received until November 14, 2008. The Privacy Commissioner is particularly interested in comments from those directly affected by covert video surveillance, including unions representing employees of federally regulated organizations as well as consumer associations.

*Only the scenario in the first bullet was found to be in violation of PIPEDA.

Private eye Steve Rambam: Privacy is dead

2008-10-13T16:01:00.000-07:00

Private investigator Steve Rambam has worked on a number of high-profile cases in his 25 year career, including tracking down Nazi war criminals in Canada. In a recent interview with Computerworld, Rambam discusses PallTech, his investigative database service with more than 25 billion records on U.S. citizens and businesses.

PallTech claims to have “ pretty much every American's name, address, date of birth, Social Security number, telephone number, personal relationships, businesses, motor vehicles, driver's licenses, bankruptcies, liens, judgments -- I could go on and on”

If the fact that PallTech has amassed this much specific information on almost every American isn’t troubling enough, there are two other disturbing issues raised in the interview. The first is the apparent lack of security or oversight of the sensitive data. When asked who has access to the data and how it is safeguarded, Rambam replies:

This is a database that's restricted to law enforcement, private investigators, security directors of companies and people who have a genuine need. … The most restrictive rule is my own personal ethics. In 20 years, we haven't had a single lawsuit or complaint.

The second troubling issue is how the data is being contributed:

The other thing is the mind-boggling level of self-contributed data. The average person now willingly puts on the Internet personal information about himself that 20 years ago people would hire an investigator to try and get. It's extraordinary. If you know how to use the Internet, 75% of an investigation can be conducted sitting in your pajamas.

Rambam feels that people have no reason to fear that PallTech will abuse their personal information, as they are “more accountable” than the US government: “You can sue us; you can subpoena us. You can hold us to task if we do something improper. Not so the U.S. government.”

Rambam is a proponent of public access to information, in order to prevent government abuse. In an earlier post, I mentioned David Brin’s book The Transparent Society , which discusses the illusion of privacy and advocates making most information available to everyone to ensure greater transparency and accountability.

Will information remain private and "secret", or are we on a path to making it open and public?

October is Public Library Month in British Columbia

2008-10-06T12:23:00.000-07:00

According to B.C. Library Association executive director Alane Wilson, more than 98 per cent of British Columbians live in an area that is served by a public library, and this year's theme for Library Month -"Your Library, Your World" - reflects the many ways in which libraries contribute to the fabric of B.C.'s education, culture and community.

While the following video focuses on Seattle Public Library, the message about the library's role in society is true on both sides of the border:

“Radical Pragmatism” : Privacy by design

2008-09-30T21:35:00.000-07:00

Privacy protection must be built into new technologies right from inception, according to Ontario’s Privacy Commissioner, Ann Cavoukian.

In a paper she delivered yesterday at the University of Waterloo, entitled “Privacy and Radical Pragmatism: Change the Paradigm “, Cavoukian argues that enhancing surveillance and security in society does not need to be at the expense of privacy. Instead, Cavoukian advocates that "privacy-enhancing technologies" can be used to counter privacy-invading tools such as biometrics, RFID (radio-frequency identification tags) and video surveillance:

By adopting a positive-sum paradigm and applying a privacy-enhancing technology to an otherwise surveillance technology, you can develop, what I am now calling, a “Transformative Technology” – transformative because you can in effect, transform the privacy-invasive features of a given technology into privacy-protective ones. Among other things, transformative technologies can literally transform technologies normally associated with surveillance into ones that are no longer exclusively privacy-invasive in nature.

In an interview with IT World, David Fewer from CIPPIC says that a lot of work still needs to be done to get the private sector on-board:

Privacy enhancing technologies are often viewed as a cost by major corporations. It will likely be the role of statutes such as PIPEDA (Personal Information Protection and Electronic Documents Act) and other … privacy laws to push companies toward investing in these privacy-enhancing technologies.

“As of now, industries will only be forced to do it when faced with an obligation to do so by regulators or when they make some kind of mistake in the marketplace and are forced to implement these technologies by some kind of legal action,” Fewer said.”

Image by Kevin Dooley

Tasteless Twittering: Newspaper tweets details of child’s funeral

2008-09-14T19:20:00.000-07:00

The decision by the Rocky Mountain News to broadcast continuous, live updates to Twitter of the details of the funeral of a three-year old boy has caused a storm of controversy among ethicists, journalists and bloggers.

Twitter, for the uninitiated, is a social networking service that uses instant messaging to allow users to share information about what they are doing at any given moment. Updates, known as “tweets” are displayed on the sender’s page and automatically sent to subscribers.

Most Twitter users share the mundane details of everyday life, answering the question “What are you doing now?” Lisa Reichelt, on her disambiguity blog, refers to this as “ambient intimacy”:

Ambient intimacy is about being able to keep in touch with people with a level of regularity and intimacy that you wouldn’t usually have access to, because time and space conspire to make it impossible. … There are a lot of us, though, who find great value in this ongoing noise. It helps us get to know people who would otherwise be just acquaintances. It makes us feel closer to people we care for but in whose lives we’re not able to participate as closely as we’d like.

One benefit of twittering is that updates can be made frequently, facilitating uses such as marketing, micro-blogging, networking and breaking news. You can track Barack Obama on the campaign trail, follow TechCrunch’s blog updates, stay up-to-date with NASA’s Phoenix Mars Lander or catch breaking news from the CBC. Twitter has also been used to share the blow-by-blow account of a couple’s argument or even to offer a proposal of marriage.

Given the broad spectrum of information that can be shared via Twitter, what then, is the etiquette? What is appropriate twittering and what is taboo? In the case of the funeral for three year-old car crash victim Marten Kudlis, many believe the good taste envelope was pushed to the limit. Reporter Berny Morsen’s play-by-play of the toddler’s funeral seemed voyeuristic and lacking in the reverence one would expect from newspaper coverage of such an event.

While shocking, it is simply a more extreme example of how the use of technologies such as Twitter is blurring the line between what is public and what should be private.

20th century etiquette expert Emily Post noted that: “People who talk too easily are apt to talk too much, and at times imprudently”. The need to feed Twitter followers with a steady stream of updates, coupled with the immediacy of the technology, encourages users to post before thinking.

Margaret Mason, contributor for The Morning News, perhaps says it best: “What’s rude in life is rude on Twitter.”

Google Responds to Privacy Concerns with Chrome

2008-09-09T22:16:00.000-07:00

Google plans to anonymize the IP addresses and cookies that track users when they enter search terms or URLs into Google’s new browser, Chrome.

Privacy advocates have been concerned about the potential of the browser to allow Google even more ability to track users’ online habits and develop extensive user profiles.

Electronic Frontier Foundation technologist Peter Eckersley says: “We're worried that Chrome will be another giant conveyer belt moving private information about our use of the Web into Google's data vaults. Google already knows far too much about what everybody is thinking at any given moment."

Google also plans to anonymize user IP addresses nine months after they have been collected.

Regulators and policymakers have been scrutinizing Google’s privacy practices for the past year, and this seems to be yet another example of the company’s lack of attention to privacy and failure to fully disclose how data will be used.

Image by Randy Zhang

Privacy Mode Planned for IE8

2008-08-23T14:28:00.000-07:00

Internet Explorer 8, due for release later this year, will incorporate a private browsing feature. According to CNET, Microsoft registered two trademarks in July which point to privacy functionality in the browser - ClearTracks and Inprivate:

The Cleartracks trademark involves "computer programs for deleting search history after accessing Web sites," according to the Microsoft filing. And the Inprivate trademark involves "computer programs for disabling the history and file caching features of a Web browser; and computer software for notifying a user of a Web browser when others are tracking Web use and for controlling the information others can access about such use."

Mac's Safari already has a private browsing mode while Firefox's PrivateBrowsing is in development. With all three, private browsing is envisioned as a temporary mode, that users will need to switch on at times when they do not want to leave behind a search trail.

Photo by: Sunside

Canada's Privacy Commissioner on Social Networking

2008-02-18T12:31:00.001-08:00

This video, from the Office of the Privacy Commissioner of Canada, Jennifer Stoddart, wants users of social networks to pause and ask themselves the following questions before posting personal information online:

What judgments or conclusions might others form with my information?
Are there some details about my life I would like to keep personal?
Who might view or purchase this information about me?
Will this information reflect well on me a year from now? Five years?
Would I want my best friend to know this?
Would I want my boss to know this?
Would I want my mom to know this?

For more information, visit the website of the Office of the Privacy Commissioner of Canada.

Tracking Transience: Hasan Elahi's Life is an Open Book

2008-02-10T01:57:00.000-08:00

In 2002, Hasan Elahi was detained at the Detroit airport when his name had mistakenly been added to the FBI’s terrorist watch list. An art professor at Rutgers University, it took six months of interrogation and nine lie detector tests before Elahi’s name was cleared.

In order to ensure that he wouldn’t be detained again, Elahi, a frequent traveller, began to routinely contact the FBI to advise them of his travel plans. He then decided to create Tracking Transience, a website where he uses time-stamped digital photos to track his own whereabouts. In addition to providing his location throughout the day by posting aerial photographs from Google Earth, he has uploaded his cell phone logs and even his bank statements to the site.

Why? Elahi’s intent is to explore the meaning of identity in an era of surveillance. While Tracking Transience robs him of his personal privacy, it also provides him with a running alibi, should he ever be falsely accused again. For his next project, he plans to post his own genome.

While Elahi’s website may seem radical, the reality is that many people are providing just as much personal information on the Internet in only slightly less overt ways. Whether twittering the details of your every waking moment, posting home videos onto MySpace, updating your Facebook status, paying your credit card online or making a purchase on E-Bay, all of these details could potentially be mined to form a clear picture of your identity.

Instead of looking over his shoulder and worrying that Big Brother is watching him, Elahi has placed himself under constant surveillance.

Photo by mikey_k on Flickr. Creative Commons Attribution-Noncommercial 2.0 Generic

January 28th is Data Privacy Day

2008-01-26T17:08:00.000-08:00

The IAPP (International Association of Privacy Professionals) has declared January 28, 2008 "Data Privacy Day", in an effort to encourage privacy professionals to give presentations at schools, colleges and universities next week on the importance of privacy.

To assist privacy professionals in their goal, the IAPP is providing some free materials, including a slideshow and handouts on teens and social networking: worthwhile reading for many parents too!

If you're a privacy professional, educator or just concerened about privacy awareness, you may want to consider using these for your own presentation or as a springboard for discussion.

Fair Copyright for Canada

2008-01-09T19:29:00.001-08:00

Michael Geist is spearheading a movement on Facebook to raise awareness about the Canadian government's plans to introduce new copyright legislation that is expected to cave in to U.S. government and lobbyist demands:

The new Canadian legislation will likely mirror the U.S. Digital Millennium Copyright Act with strong anti-circumvention legislation that goes far beyond what is needed to comply with the World Intellectual Property Organization's Internet treaties. Moreover, it will not address the issues that concern millions of Canadians. For example, the Conservatives' promise to eliminate the private copying levy will likely be abandoned. There will be no flexible fair dealing. No parody exception. No time shifting exception. No device shifting exception. No expanded backup provision. Nothing that focuses on the issues of the ordinary Canadian.

Instead, the government will choose locks over learning, property over privacy, enforcement over education, (law)suits over security, lobbyists over librarians, and U.S. policy over a "Canadian-made" solution.

The Facebook group has grown to nearly 40,000 members and is garnering lots of media attention in Canada.

Geist, Canada Research Chair of Internet and E-commerce Law at the University of Ottawa, talks more about what's at stake with this proposed legislation in this CBC interview:

Facebook ordered to get tougher on privacy for children

2007-10-17T18:56:00.000-07:00

In response to a spate of issues involving sexual predators using MySpace, Facebook began promoting itself as a safe online environment for children. To test their claims, investigators from the New York Attorney General’s office posed as teenagers and within a matter of days after posting their profiles on Facebook, had received numerous sexually suggestive messages from adults. Their complaints, registered using Facebook’s online form, went unanswered for weeks.

As a result of their investigation, New York state prosecutors accused Facebook of false advertising and the New York Times reports that yesterday, Facebook was ordered to immediately post stronger warnings about the risks to children using the site and to provide a quicker response to thousands of complaints daily about inappropriate sexual messages.

The changes are part of a settlement with the New York attorney general, Andrew M. Cuomo, whose office last month announced that it had been investigating whether the Web site misled users by promoting itself as a place where minors were safe from sexual predators.

Mr. Cuomo said the settlement would serve as a “new model” under which law enforcement and Internet companies could work together to protect children and recognize that they share responsibility to police illegal activity online.
By using consumer-protection laws to tackle the thorny problem of Internet safety, Mr. Cuomo appears to be building on the tactics of his predecessor, Gov. Eliot Spitzer, who used state laws to prosecute fraud on Wall Street.

“Any site where you are attracting young people, you must assume you are simultaneously attracting those who would prey on young people,” Mr. Cuomo said in an interview. “Whether you are a shoe company or you’re an Internet company, consumer protection laws apply.”

Chris Kelly, Facebook’s chief privacy officer, stood beside Mr. Cuomo to announce the deal and called the settlement part of the company’s effort to grow while maintaining users’ sense of safety and community. “We actually think we’ll end up attracting more people” because of the new measures, he said.

The settlement also requires Facebook to hire an independent company to track its responses to complaints and to report twice a year to Facebook and the attorney general.

In an earlier post, I expressed concern about Facebook’s default “wide-open” privacy settings and their announcement that profiles would be made available to third parties and eventually over the Internet using an automatic opt-in model. I complained to Facebook about this practice and my particular concern about the risks to minors. While their response was timely, coming within a few days of my original complaint, it completely skirted my concerns about using a negative opt-out, as well as the issue of putting children at risk:

We appreciate your feedback and will take it into consideration moving forward. Please keep in mind that a public search listing is simply a basic search result that allows people to know that you have a Facebook profile even if they do not yet use the site. Your public search listing will only be available if you allow “Everyone” to search for you on Facebook and have the “Allow anyone to see my public search listing” checkbox toggled on. You can adjust these settings from the Search section of the Privacy page.

Also note that people who do not yet use Facebook will not be able to interact with you or view your full information without registering with the site. Your public search listing will not affect any of your normal Search privacy settings. A non-Facebook user viewing your result would see the same search result if they registered with the site.

Your public search listing will also eventually appear in search engine indexes, making it even easier for your friends to connect with you. To change this option, please go to the Search section of the Privacy page and deselect the option to “Allow my public listing to be indexed by external search engines.”

By more efficiently connecting people, we hope that we can make your experience more meaningful on the site. Let me know if you have any further questions.

Thanks for contacting Facebook,

Kristjan
Customer Support Representative
Facebook

If Facebook truly cared about their users' privacy, and particularly the privacy of minors, their user profiles would default to allow maximum privacy, allowing users to choose to opt in to make their profiles available for searching on the Web. In light of these kinds of policies and their response to valid privacy concerns, it’s encouraging to see the privacy practices of social-networking sites like Facebook coming under closer scrutiny, particularly with respect to the safety of children.

Librarians: best knowledge managers for our new world

2007-10-09T17:47:00.000-07:00

From the b.eye Business Information Network, Dr. Ramon C. Barquin has an informative article about the role that modern librarians can play in the brave new information world.

If there is one profession that has traditionally been underutilized in terms of the contribution they can make to business intelligence and knowledge management, it is the librarians.

...Finding anything and making sense out of it as we move from intelligence to knowledge will be very challenging. ...I would take every major portal where navigation is a problem and give a group of librarians the job of improving it.

...That is where librarians can make a big difference. Give them the right tools, and they will become the best knowledge managers for our new world.

Read the rest here.

Homeland Security's Chertoff: more surveillance, less privacy

2007-10-06T15:14:00.000-07:00

Americans are increasingly more willing to trade privacy for security, according to a recent Washington Post poll, and comments by Michael Chertoff, U.S. Secretary of Homeland Security at the International Data Protection and Privacy Commissioner's conference in Montreal earlier this week reflect this outlook.

Michael Geist reported on the BBC news site about Chertoff’s presentation at this year’s global privacy conference, where the theme was “Terra Incognita”, the latin term for unknown lands:

In a room full of privacy advocates, Chertoff came not with a peace offering, but rather a confrontational challenge.

He unapologetically made the case for greater surveillance in which governments collect an ever-increasing amount of data about their citizens in the name of security.

For example, in support of his security agenda, he noted that US forces in Iraq once gathered a single fingerprint from a steering wheel of a vehicle that was used in a bombing attack and matched it to one obtained years earlier at a US border crossing.

He added that there was a similar instance in England, where one fingerprint in a London home linked to a bombing was matched to a fingerprint gathered at a US airport (the identified person was actually innocent of wrongdoing, however).

Chertoff explained that in the autumn the US intends to expand its fingerprinting collection program by requiring all non-Canadians entering his country to provide prints of all ten fingers (it currently requires two fingerprints).

In the process, his vision of a broad surveillance society - supported by massive databases of biometric data collected from hundreds of millions of people - presented a chilling future. Rather than terra incognita, Chertoff seemed to say there is a known reality about our future course and there is little that the privacy community can do about it.

David Brin’s book The Transparent Society discusses the illusion of privacy and advocates making most information available to everyone to ensure greater transparency and accountability. Security does seem to be prevailing over privacy, and, ironically, greater openness is regarded as the means to safeguard personal liberties. It’s a frightening prospect in many ways, but perhaps a more palatable option than the current move to consolidate information into the hands of government, corporations, the military or police.

Chertoff's observations are provocative and may lead our privacy commissioners to shift the debate from "privacy versus security" to focus more on issues of accountability and oversight.

2020: The future of surveillance

2007-09-11T12:17:00.000-07:00

Imagine a world where …

- every single one of your activities outside your home was monitored on closed-circuit cameras

- your computer’s ip address was fixed, allowing anyone to track your activity and making your computer a hot property for thieves wanting to hide their identity

- all monetary currency has disappeared and your electronic transactions are all tracked, unless you pay extra to "scrub" your transaction

- you will be required by law to wear an identity transponder at all times so that you can be readily identified

- your insurance company is able to monitor the groceries you buy and what you consume in a restaurant in order to charge higher rates to subscribers who eat junk foods

These are just some of the predictions forecast in DM News by Robert Gellman, a Washington-based privacy and information policy consultant and former chief counsel to the U.S. House subcommittee on information, justice, transportation and agriculture.

2020 is just 13 years away – how close are we to living in the world that Gellman predicts?

Photo by: Gavin Stewart, Creative Commons Attribution 2.0

Facebook uses negative opt-out to make profiles public

2007-09-06T10:40:00.000-07:00

Facebook users received notifications this week that the company is planning to make user profiles available to non-users and eventually make them searchable on the Internet, as reported today by the BBC:

The function will initially allow anyone who is not registered with the site to search for a specific person. More controversially, in a month's time, the feature will also allow people to track down Facebook members via search engines such as Google.

The firm said that the information being revealed is minimal.

… The public search listing will show the thumbnail picture of a Facebook member from their profile page as well as links allowing people to interact with them. But, in order to add someone as a friend or send them a message, the person will have to be registered with Facebook.

Users who want to restrict what information is available to the public or
opt out of the feature altogether can change their privacy settings. They have a
month to do so.

Facebook originated as a “closed” space, targeting university and college students whose e-mail addresses had to originate from their academic institution’s domain. Last year, Facebook opened its service to anyone, but part of the appeal to users is the ability to restrict access to your profile within the Facebook environment.

Now, Facebook is pulling down the walls of their environment and allowing anyone, anywhere to see its users’ profiles – unless users choose to opt out. The negative opt-out technique means that if users do not respond, Facebook will assume they have granted permission for their profiles to be made public.

Roger’s Cable in Canada tried the negative option technique in the mid-90’s, delivering a package of new speciality services with automatic increased costs to customers’ bills. Customers were outraged, the company backed away from their plan and by 1999, Canadian parliament outlawed the practice.

The negative opt-out is at best unfair and at worst a huge violation of trust:

It presumes that everyone will read the opt-out notification within the month – there are purportedly 39 million Facebook accounts, a large percentage of which have likely become inactive or are used infrequently, so those users’ information will probably go public without their knowledge or consent.

It takes advantage of a low response rate. Studies have shown that only about 15% of users will respond to a negative opt-out. Facebook stands to make a greater profit using this method than requiring users to opt in.

It takes advantage of the relationship developed between service provider and customer. Facebook is presuming that it can use its customers’ information in whichever way it deems fit, with a minimum of input from users.

It puts users – including minors – at risk by exposing their profile information to the wider world. Many Facebook users are not well-informed about the myriad of privacy settings required to lock down one’s profile. Many users leave their entire profile, including date of birth, workplace, residential neighbourhood and status (e.g. “I’m vacationing in Aruba all week!”) open to entire networks of thousands of members to view. While users’ entire profiles will not be available to search on the Web - not yet, anyway – it opens the door for greater abuse.

In using the negative opt-out technique, Facebook is violating the trust and the privacy of millions of loyal users. If users and regulators allow Facebook to proceed with this tactic - what's next? What other web services do you use that may decide to share your personal information or web history with a third party, assuming that your silence to a negative option grants them your "permission"?

Lessons from the massive privacy breach at Monster.com

2007-09-01T21:56:00.000-07:00

Last week’s massive security breach affecting Monster.com is a reminder of what is at stake as we all come to rely on web-based services for everything from shopping to dating to job searching. For those unfamiliar with the service, Monster.com is an international job search site, where employers can post job ads and employees can post their resumes and apply for positions. According to CRN Business:

The stolen data, which was found on a remote server and shut down by Monster.com this week, included users' names, addresses, phone numbers and e-mail addresses. Symantec security researchers first reported the incident last week, although it's still not clear when the breach first occurred.

The data was collected by the Trojan Infostealer.Monstres, which likely used stolen login credentials of legitimate employment recruiters to gain access to the site's resume database, according to a posting by Symantec researcher Amado Hidalgo on Symantec's Web site. The unsuspecting job seekers whose information was stolen then became the victims of various phishing e-mail scams attempting to empty their bank accounts.

Last week’s reports indicated that a staggering 1.3 million individuals’ data had been stolen, but Monster.com’s CEO Sal Iannuzzi is now saying that the breach is likely even larger:

To be safe, he said, all Monster.com users should assume that their contact information has been taken.

While Monster is assuring users that it is working to improve security on their site and contacting users about ways they can ensure their privacy, this is too little too late given that millions of users’ confidential data, including names, residential addresses, e-mail addresses, home telephone numbers, cell phone numbers and employment history have been stolen by individuals who have not been identified or arrested for purposes yet unknown. It is not yet known if any financial transaction data has been stolen.

Ianuzzi offers little comfort to Monster’s customers:

"I want to be clear and I want to be frank: There is no guaranteed fix," Iannuzzi said. "I wish I could say . . . there will be absolutely no way that the Monster site can be compromised. I cannot ever make that promise, and no Internet company can." (emphasis is mine).

This is a sobering reality check to all of us who share information and make transactions on the Web – that there are no iron-clad guarantees for the security of your data, financial or otherwise. It is up to individuals to stop and think before providing any personally identifiable information to access a service or conduct a transaction over the Internet.

Some ways you can reduce your risk:

1. When signing up for a Web service – anything from Facebook to Ticketmaster alerts to a blogging utility – how much personally identifiable information are you required to provide? How important is the service to you when weighed against the risk of your personal data being stolen or unlawfully accessed?

2. Could you access this service in another way? For example, is it possible to apply for a job by e-mailing the employer directly, rather than uploading all of your application data to a Web service?

3. When you are making an on-line purchase, be sure the vendor is providing a secure means of making the transaction – look for the https:// prefix in the URL (e.g. https:// www.abc.com). You should see a lock box on your screen if the site is secure.

4. Make sure you run anti-virus software regularly to ensure that key sniffers are not at work on your computer. Because you cannot be assured that this is happening in libraries and internet cafes, don’t access your on-line banking service or make financial transactions on public Internet computers.

5. If you are using a wireless Internet connection, secure it to ensure that no one can access your computer.

6. When making a transaction online, always decline the option for the service to retain your credit card information. The inconvenience of re-keying this information is not worth the risk of a data breach.

7. Vote with your feet and with your money. Don't support companies or services that aren't taking data security seriously. If you have a concern about the amount of personal data you are required to provide in order to access a service, don't go ahead with the transaction. Write the companies and let them know your concerns. Read their privacy policy thoroughly.

Unfortunately, even using these precautions will not eliminate your risk. A few months ago, I wrote about how in-person shoppers at TJ Maxx stores had their credit card information stolen because the company’s databases were breached and they retained the data far longer than required to support the transaction. Regulations to protect consumers are lagging and differ from country to country and within state and provincial jurisdictions. Many companies are lax in protecting consumers and do not provide the level of I.T. support required to secure data.

Most of us wouldn’t leave our houses without locking the doors, but we can so easily become complacent about the amount and type of personal information we share in our day-to-day activities.

Always ask yourself: is the convenience worth the potential risk?

This is Privacy Awareness Week

2007-08-27T10:35:00.000-07:00

Privacy Awareness Week is a promotional campaign first initiated by Privacy Victoria (Australia) in 2001. This year, for the first time, Privacy Awareness Week has gone international.

The week is an opportunity for organizations and agencies covered by privacy legislation to promote privacy awareness to their staff, customers, and to the wider community. The theme for Privacy Awareness Week 2007 is ‘Privacy is your business'.

Do you know your rights and obligations with respect to privacy? Organizations, governments, and government agencies in many countries are bound by a variety of privacy laws. As consumers, each of us is responsible to understand what our rights and responsibilities are under those laws.

Learn more about your rights!

International: Privacy International and Electronic Frontier Foundation

In the U.S.: Office of Information and Privacy, U.S. Department of Justice and American Civil Liberties Union

In Canada: Office of the Privacy Commissioner of Canada and CAPAPA

In the U.K.: Information Commissioner's Office

In Australia: Privacy Victoria

Andrew Feldmar on the Colbert Report

2007-08-21T12:12:00.000-07:00

Back in April, I wrote about Canadian researcher Andrew Feldmar, who was held at the border and subsequently barred from entry into the U.S. because a border guard googled his name and discovered he'd tried LSD in the name of scholarly research over 30 years ago.

Last night, the Colbert Report submitted a "Nailed 'em" report on Feldmar's story, which you can view today on the show's website. Today, the Tyee published an account by Feldmar's son about filming the episode, which in typical Colbert style points out the lunacy behind a policy that would bar from entry into the U.S. a respected researcher who has never been charged or convicted of a criminal offense.

Ask.com and Microsoft call for privacy standards

2007-07-25T16:36:00.000-07:00

According to PC World, Ask.com will be the first major search engine to offer an anonymous searching option to users. Their new AskEraser feature will give users the option to request that their search data not be stored.

This is in stark contrast to Google’s recent announcement that they will reduce the time they save search data from over 30 years to “only” two years. In spite of Google’s voluntary reduction in cookie life, European privacy experts, among others, have soundly criticized the lifespan of Google’s cookies:

"Compared to the previous lifetime of 30 years, the period of two years seems to be short," Schaar wrote in an email. "But from a data-protection perspective, and considering the fact that the user's search behaviour is recorded and can be analysed for any purposes, this period is still too long."

Meanwhile, Microsoft has joined Ask.com in calling on technology leaders to find a way to meet their need for advertising data without compromising user privacy:

"The first step is, we'll be in contact with all the other players in this space and talk about what a summit might look like," said Cullen. "We're very happy to host it, if that's the answer ... both Microsoft and Ask.com think that this is the time to make this happen."

Microsoft is planning to allow users to opt out of having their search data used to generate targeted advertising on Microsoft's Web sites, and under a new privacy policy, plans to scrub all search query data of any user-identifiable information after 18 months. While this is in part a shot at Google, it is encouraging to see some leadership within the industry to safeguard the privacy of their users’ search data.

The ability to search anonymously is essential in allowing individuals to explore any area of inquiry without fear of discovery or retribution. When companies track user data, their primary motivation is to inform their decisions about advertising. The abuse of search data has additional implications if the data is merged with that of advertisers, as I wrote in an earlier post about the proposed Google and DoubleClick merger.

When search data is breached, the consequences could be far more serious than mere embarassment. About a year ago, AOL inadvertently released the search data for about 650,000 searches on their site and New York Times reporters were actually able to identify one of the searchers. Breaches of this magnitude and specificity could ruin careers and reputations, while creating a chilling effect on the exploration and sharing of ideas over the Internet.

Google needs to stop hedging on privacy and get on board with this initiative.

What's next for net neutrality?

2007-07-17T10:55:00.000-07:00

Over 29,000 comments were submitted to the FCC since they opened their inquiry into net neutrality in March. About 670 additional comments were filed by groups and individual Internet users yesterday, the deadline for responding.

IT World has a summary of some of the comments received, including this one:

Bonnie Bennett of California seemed to take a more individual approach in her e-mail to the FCC. "Free, unlimited access to the Internet is the modern-day version of how to educate the citizenry of a well-functioning democracy," she wrote. "Big companies and global corporations care a lot about profits and stockholders but not much about educating citizens."

Even Google and Microsoft have been advocating through the Computer & Communications Industry Association for a net neutrality rule to address the lack of competition among broadband providers:

Broadband providers "insult the commission's expertise by summarily proclaiming
the broadband access market competitive without any specific evidence of
competition," the group said.

The other side of the issue was represented in comments by Hands Off the Internet, an advocacy group representing AT&T Inc., Alcatel-Lucent SA, the American Conservative Union and other organizations:

"There is no current or anticipated content discrimination or service degradation justifying new regulations by the commission," wrote Christopher Wolf, co-chairman of Hands Off the Internet. "Moreover, regulation could well thwart Internet growth and make consumer access unfairly expensive."

Tim Berners-Lee, the man who invented the World Wide Web in 1989 at CERN weighed in on the side of regulation in an interview in IT World:

I think it's very important to keep an open Internet for whoever you are. This is called Net neutrality. It's very important to preserve Net neutrality for the future.

So, what’s next? Will government regulation be introduced or will the free market be allowed to determine this issue? Based on what I’ve read in the past month or so, I have a feeling that the FCC will advocate the hands-off approach supported by the recent FTC report, which cited existing anti-trust laws and a complaints procedure to protect consumers. Stay tuned….

Related posts:

Time is running out for net neutrality
Federal Trade Commission report on net neutrality
Net neutrality: 21 days left to save the Internet

Time is running out for Net Neutrality

2007-07-09T09:57:00.000-07:00

Just 6 days remain in the Federal Communications Commission’s public inquiry into whether it should protect Net Neutrality and the outlook isn’t good. A few weeks ago, the Federal Trade Commission issued a report recommending against legislation to protect net neutrality. The IDC, one of the few big voices actually in favour of net neutrality, is predicting that “regulation around net neutrality will be decided in favor of facilities-based broadband providers like AT&T, Verizon, and Comcast.”

Why should you care? According to SaveTheInternet.com:

The consequences of a world without Net Neutrality would be devastating. Innovation would be stifled, competition limited, and access to information restricted. Consumer choice and the free market would be sacrificed to the interests of a few corporate executives.

On the Internet, consumers are in ultimate control — deciding between content, applications and services available anywhere, no matter who owns the network. There's no middleman. But without Net Neutrality, the Internet will look more like cable TV. Network owners will decide which channels, content and applications are available; consumers will have to choose from their menu.

The free and open Internet brings with it the revolutionary possibility that any Internet site could have the reach of a TV or radio station. The loss of Net Neutrality would end this unparalleled opportunity for freedom of expression.

The Internet has always been driven by innovation. Web sites and services succeeded or failed on their own merit. Without Net Neutrality, decisions now made collectively by millions of users will be made in corporate boardrooms. The choice we face now is whether we can choose the content and services we want, or whether the broadband barons will choose for us.

Why should Canadians care? Michael Geist wrote an excellent article in the Toronto Star about Canadian culture and the issue of net neutrality:

Ensuring access is also an important part of the equation, as regulators should preserve the right of Canadians to access the content of their choice on the Internet through net neutrality legislation.

So, if you care, act now while there is still time:

1. Watch the video for a primer on the issue.

2. Learn more. The Digital Nomad has an informative post with links to more information.

3. Sign the petitions at Save the Internet or Neutrality.ca today.

4. Spread the word through your own blog with a post on the topic and with one of these U.S. badges or Canadian badges.

Privacy Rights and Terror Investigations

2007-07-03T11:16:00.000-07:00

Two recent developments on the international cooperation front provide some redress to concerns about privacy and information-sharing between governments. The introduction of no-fly lists in the U.S., Canada and the E.U., as well as the increasingly globalised nature of personal information in data banks has raised questions about how this information will be shared with and used by foreign governments.

A tragic example of the failure to provide protection to citizens in these areas is the story of Maher Arar, a story familiar to most Canadians:

Maher Arar, a Syrian-born Canadian citizen was detained during a layover at John F. Kennedy International Airport in September 2002 on his way home to his family in Canada. He was held in solitary confinement in the U.S. for nearly two weeks, interrogated, and denied meaningful access to a lawyer. The Bush administration labeled him a member of Al Qaeda and rendered him, not to Canada, his home and country of citizenship, but to Syrian intelligence authorities, known by the U.S. government to practice torture.While in Syria, he was regularly tortured for almost a year before being released to Canada. Both the Canadian and Syrian governments have publicly cleared Arar of any links to terrorism. The United States government, however, refuses to clear Arar’s name and continues to have both him and his family on a watchlist.

Mr. Arar’s incarceration was the result, in part, of misleading information provided by the RCMP, which eventually led to the resignation of the RCMP commissioner. Following Mr. Arar’s return to Canada, there were several intentional disclosures to the public from his file, which appeared to be made in order to justify the actions of the security agencies involved. These disclosures were in violation of Mr. Arar’s privacy rights.

In our increasingly globalised economy, the volume of personal data crossing borders represents a growing threat to personal privacy. In an effort to counter the threat, the Organization for Economic Cooperation and Development (OECD) has issued a report proposing amendments to data privacy legislation as well as enhancements to international cooperation in the field of privacy protection:

When personal information moves across borders it may put at increased risk the
ability of individuals to exercise privacy rights to protect themselves from the
unlawful use or disclosure of that information. At the same time, the authorities charged with enforcing privacy laws may find that they are unable to pursue complaints or conduct investigations relating to the activities of organisations outside their borders. Their efforts to work together in the cross-border context may also be hampered by insufficient preventative or remedial powers, inconsistent legal regimes, and practical obstacles like resource constraints. In this context, a consensus has emerged on the need to promote closer co-operation among privacy law enforcement authorities to help them exchange information and carry out investigations with their foreign counterparts.

While most OECD member countries have enacted privacy legislation, Canada's Privacy Commissioner Jennifer Stoddard has pointed out that different rules in different countries were not only causing unease among citizens and companies, but were also leading to more red tape and higher costs.

Meanwhile, The European Union and the U.S. have reached a provisional deal on exchanging information about transatlantic air passengers. According to a TechWorld News story, the U.S. will be required to adhere to "strict data retention obligations," including retaining both used and unused data for no more than five years.

The United States and European Union share views on combating terrorism but
"these activities should be done in full respect for fundamental rights," said
Franco Frattini, the EU's justice and home affairs commissioner.

While privacy protections need to go even further than these two initiatives, it is encouraging to see some developments that attempt to preserve individual privacy rights and hopefully prevent a recurrence of the nightmare that Maher Arar experienced.

Federal Trade Commission report on Net Neutrality

2007-06-28T11:06:00.000-07:00

The Federal Trade Commission (FTC) has issued their report on Broadband Connectivity Competition and are warning against legislation to ensure net neutrality.

An Internet News article reports:

The FTC was unable to find any significant market failure or
demonstrated consumer harm from conduct by broadband providers.

"Policy makers should be wary of calls for network neutrality regulation simply because we do not know what the net effects of potential conduct by broadband providers will be on consumers," the report states. "Similarly, we do not know what net effects regulation to proscribe such conduct would have on consumers."

To learn more, read my earlier post , or click one of the buttons in the sidebar.

Update on SBINet and the Arivaca Tower

2007-06-26T19:09:00.000-07:00

The Arivaca Tower, part of the Secure Border Initiative or SBINet is getting some attention from U.S. national media. The New York Times , U.S. News and World Report and Washington Technology all have recent in-depth stories.

The launch of the high-tech virtual fence along Arizona's border with Mexico has been delayed due to technical problems. According to an Arizona Republic article:

Boeing has installed all nine portable 98-foot towers, cameras, radar and ground sensors. It has fitted 50 patrol vehicles with computer links. Mobile and central command bases have also been linked to the network. The idea is to give front-line agents and commanders up-to-the-second pictures of all the activity in their areas.But the cameras and sensors convey inconsistent information. Software glitches and integrating all the information have proved challenging.

Today the U.S. Senate voted to revive an immigration bill, supported by both Arizona's senators, that would tighten border security, create a temporary guest worker program and grant immediate legal status to millions of undocumented workers in the United States.

For background information, read my earlier posts about the Arivaca Tower.

Net Neutrality: 21 days left to save the Internet

2007-06-24T11:38:00.000-07:00

When we log on to the Internet, we expect to be able to access any site we want, regardless of whether it is run by a major corporation or a home-based business owner. Net Neutrality means that Internet Service providers cannot discriminate by speeding up or slowing down access to Web content based on its source, ownership or destination.

The largest telecommunications companies want to be able to regulate what we access, including the ability to block their competitor’s sites and to tax content providers to guarantee the speed of delivery of their content.

Save the Internet is a movement in the U.S., urging citizens to tell Congress to preserve Net Neutrality and help ensure that the benefits and promise of the Internet are available to all Americans.

In Canada, Michael Geist has set up a petition at Neutrality.ca urging the Canadian government to stand up and protect the future of the Canadian Internet.

While the definition of net neutrality is open to some debate, at the core is the commitment to ensuring that Internet service providers treat all content and applications equally with no privileges, degrading of service or prioritization based on the content's source, ownership or destination.

What you can do:

1. Watch the video for a primer on the issue.
2. Learn more. The Digital Nomad has an informative post with links to more information.
3. Sign the petitions at Save the Internet or Neutrality.ca today.
4. Spread the word through your own blog with a post on the topic and with one of these U.S. badges or Canadian badges.

Act now - there are only 21 days left to preserve a free and open Internet!

15 Steps: Privacy is your responsibility

2007-06-21T14:49:00.000-07:00

When it comes to privacy, many people believe that if they have nothing to hide, they have nothing to fear. In a world where more and more of our personal information is becoming vulnerable, we need to be reminded that privacy is our right and we must take responsibility to protect it.

Even if you are in the “nothing to hide” camp, I highly recommend you read Michael Beck’s (aka The Digital Nomad) privacy series at his blog, The Sovereign Journey. This blog is “dedicated to exploring the use of emerging technology to promote the self-ownership concepts of Natural Law, Personal Freedom, and Self-determination.”

His series will outline the 15 steps that you can take to safeguard your personal privacy. I’ll be up-front: Michael kindly reviewed my blog a few weeks ago and I’m pleased to return the favour, as we share a common interest in keeping the issue of privacy on everyone’s radar screens.

Michael’s newer blog, The Rugged Notebooks Blog, is unique as it specifically reviews technology and gadgets for those with a rugged lifestyle or occupation:

Maybe you are a digital nomad always on the go and need something a little tougher, or you work in harsh surroundings related to heat, humidity, variable atmospheric conditions, or you have an occupation requiring a computer that simply won’t let you down in extreme conditions…no matter if you accidentally drop it in water, in oil, or even a fire, then what you need is a ruggedized computer, aka "RuggedNotebooks”.

So, whether you’re a digital nomad or chained to your desktop, what steps are you taking to safeguard your privacy?

Canada's No-Fly list could be linked to biometrics

2007-06-17T19:30:00.000-07:00

Canada new “no-fly” list, to be known as “Passenger Protect”, takes effect on June 18th and according to an Ottawa Citizen report, the federal transport minister isn’t ruling out linking the names to biometric data in the long term. The Canadian no-fly list will have hundreds of names, rather than the tens of thousands on the U.S. list. Names will be added to the list based on information supplied by CSIS and the RCMP.

In an earlier post, I wrote about the risks associated with biometrics and DNA-enabled travel documents, data security and the potential impact on individual privacy. The first steps toward collecting biometric data are already underway in both the U.S. and Canada:

The United States already scans the fingerprints of foreign visitors entering the country and stores the information in a database. Visitors from Canada and some countries are excluded from the program.
Meanwhile, Transport Canada has bulked up security at airports by issuing biometric ID cards to staff who work in "restricted areas."

Canada’s Privacy Commissioner, Jennifer Stoddart has spoken out against the no-fly list, along with other privacy advocates such as Pippa Lawson, director of CIPPIC. Citizens could be the subject of mistaken identity and personal information collected by governments could make citizens vulnerable when traveling abroad or if their information is stolen or abused. The potential for abuse was highlighted at the Air India inquiry, where a Transport Minister acknowledged that the no-fly list could be shared with foreign governments.

While airlines could be fined up to $25,000 if they disclose personal information about individuals on the list, there appear to be little safeguards provided to prevent foreign governments from using or abusing this information. Passengers who feel they have been mistakenly placed on the no-fly list can appeal to the Office of Reconsideration, but are not allowed to know why their name was originally placed on the list.

Canadians are entitled to strong and rigorous guarantees from their federal government about the uses and limits of the collection and dissemination of personal information. The implications of misuse and abuse are far too serious for anything less.

Privacy has a true market value

2007-06-15T08:57:00.000-07:00

An obsessive and self-destructive screenwriter, Albert Feeld finds his life spiraling out of control as he is diagnosed with pancreatic cancer and it seems the characters from his screenplay are coming to life all around him. As he lays on his deathbed, his final strained words to his publisher are: “No … biography!” Three hundred years later, Feeld’s head, which was cryogenically frozen after his death is brought to life in a lab where scientists are studying human memory, but also extracting his memories to be broadcast as a form of entertainment – a future version of reality television. In this dystopian future, a group of terrorists fighting for “Reality or Nothing” are the final guardians of human values, including the right to privacy. As the television mogul capitalizing on Feeld’s memories says: “Who would want made-up stories from a hack when you can mainline into the real thing? At last, privacy has a true market value.”

This is just the briefest synopsis of Dennis Potter’s brilliant companion miniseries Karaoke and Cold Lazarus. You may not have heard of Potter (pictured above), but you’ve probably seen some of his work, such as Pennies from Heaven and The Singing Detective (British and U.S. version). Potter is also a fascinating and tragic individual, who suffered from a rare form of acute psoriasis; a painful condition which left him somewhat disfigured and required frequent hospitalization. He began writing Karaoke and Cold Lazarus shortly after being diagnosed with terminal pancreatic cancer and struggled to complete the stories before his death in March 1994. His wife tragically died one week before him, of breast cancer.

Why am I writing about Dennis Potter and his final works? Because when I saw Karaoke and Cold Lazarus over ten years ago on the CBC, I thought the miniseries was one of the most original, innovative and moving programs I had ever seen. As I’ve been writing so much about privacy on this blog, I recently recalled the image of Daniel Feeld’s severed head with a tear streaming down his cheek after a particularly personal memory is broadcast to the world without his consent. Daniel Feeld, who felt he was losing control when he was alive and feared the publication of a biography following his death, is sentenced to a hellish eternity where he is forced, helpless, to re-live and share his most intimate thoughts and memories.

In our present, where countless private and government databanks have the potential to be merged and form a picture of the most private details of our lives, thoughts and activities, Potter’s words “Privacy has a true market value” seem far more prophetic than they did when this miniseries was first broadcast.

I wish I could link you to the DVD of this great miniseries, but sadly, the rights are being fought out between Channel 4 and the BBC, and no commercial copies exist, so the best I can do is link to Potter’s screenplay. If Channel 4 and the BBC ever get it sorted out – and they owe it to the memory of Potter to do so and to do it soon – I’ll be among the first of Potter’s fans to let you know.

TJ Maxx: Privacy and Consumer Apathy

2007-06-13T16:53:00.000-07:00

Information Week is reporting on the financial statements for TJ Maxx following the massive security breach last year and – surprise! – sales at the retailer are up 6% over last year.

Given the scale of the breach – customer financial information dating back to 2003 was stolen – and the revelation that TJ Maxx was retaining far more information on customers far longer than required to support the transaction, I am surprised that sales did not go down. What message are customers sending to retailers about the importance of privacy and the trust that consumers place in them when making a transaction? Are customers so weary of hearing about security breaches that they have become apathetic to the issue?

It’s not that TJ Maxx hasn’t made an effort to redress the problem:

The company reported a charge of $20 million, or 0.5% of net sales for the last
quarter of 2006 toward investigating and containing the computer intrusion, work
to improve the company's computer security and systems, communicating with
customers, and technical, legal, and other related costs

And many irate consumers are taking the issue to court:

TJX is facing class-action lawsuits from customers in state and federal courts
in Alabama, California, Illinois, Massachusetts, Michigan, Ohio, and Puerto
Rico, as well as in provincial Canadian courts in Alberta, British Columbia,
Manitoba, Ontario, Quebec, and Saskatchewan. Additional class-action suits from
financial institutions affected by the computer intrusion -- those issuing
credit and debit cards used during the time of the intrusion -- have been
filed against TJX in federal court in Massachusetts. All-told, nine lawsuits
have been filed against TJX since April 17.

Still, it is stunning that a retailer can expose consumers to one of the largest and most costly security breaches in history and the shoppers just keep on shopping.

More Local Reaction to the Arivaca Tower

2007-06-09T23:49:00.000-07:00

A tip of the hat to Otto at Otto's Random Thoughts, who alerted me to Southwind Dancer, a blog by local Arivacans about the Arivaca Tower. Along with Arivaca AZ Online , this blog provides good insight to the issues facing residents living in the shadow of the Tower. The image at right is a copy of a poster from the Arivaca AZ Online site, which I hope they won't mind me reproducing here. Arivacans appear to be well-organized in their protest against this Department of Homeland Security pilot project (click the "Secure Border Initiative" label at the end of this entry to see all of my previous posts on this topic).

As Otto is leaving Arivaca soon to take the post of Associate Professor of International and Comparative Politics at American University of Central Asia, I wanted to thank him for pointing me to these local resources and wish him all the very best in his exciting new role. I'll be continuing to follow developments on the Arivaca Tower in future posts.

Biometrics and DNA-enabled passports

2007-06-05T15:12:00.000-07:00

About 10 years ago, a large brown envelope arrived in my mailbox from my old alma mater. It contained a request for me to participate in a long-term research study that the university was undertaking on the effects of drinking water from Lake Ontario, which I had been drinking for most of my life. The large brown envelope also contained a much tinier brown envelope into which I was to deposit the clippings of all ten of my toenails. Once I got past the "ew…gross" factor, I began to ponder the implications of sending away little pieces of my DNA that were to go on file for a decades-long study. Despite the assurances from this well-respected university that my toenail clippings would be kept secure and not used for any other purpose, I opted not to participate, as I just did not feel comfortable with the prospect.

Fast-forward a decade and it appears that our governments will eventually be forcing us to provide DNA samples, if we ever want to travel outside the country, that is. According to a CanWest News report:

Canadians will inevitably have to carry travel documents with their DNA,
biometrics or other biological identifiers in order to ensure secure border
travel to the United States, according to a new white paper to be revealed to
government officials in Ottawa Monday.

Although some technology, such as DNA-enabled passports or driver's
licences, may be a long way off, terror threats and other looming risks mean
governments must begin to seriously consider how they will introduce those
measures in the future, [said Michael Hawes, executive director of the
Foundation for Educational Exchange between Canada and the United States of
America.]

The white paper will outline the implications of the U.S.’s Western Hemisphere Travel Initiative, which earlier this year required Canadians flying into the U.S. to carry a passport and which will require all Canadians driving or walking across the border to have a passport by 2008.

A few toenail clippings in a university researcher’s file cabinet are a minor concern compared to a DNA profile being available in electronic format to my own government, let alone a foreign government. While the purpose is to guarantee that I am who I say I am when traveling in and out of my country, what would happen if the electronic representation of my DNA were stolen? Just ask someone who shares a similar name to someone on the U.S. "no-fly" list how easy it is to prove who they are: how much more difficult and dangerous will it be if your DNA profile is stolen or altered?

It raises the question of ownership of the data and informed consent to citizens about how it will be used. Citizens should have assurances that their DNA profile will not be collected or saved by foreign governments and that the information will not be made available to other government agencies or third parties. Genetic information from DNA and other biometric information can be dangerous not only if it is used to assume someone’s identity, but also if it reveals health or social information that could be used in a negative way against the owner.

The use of biometrics and DNA seems inevitable in an increasingly security-obsessed world. As citizens we need to pay very close attention to these initiatives and the laws in place to protect our identity.

What type of technology user are you?

2007-05-31T16:22:00.000-07:00

So, are you an omnivore, a connector or a productivity enhancer? Do you feel connected, but hassled; light, but satisfied; or just plain indifferent? Do you know someone who’s completely off the network?

These are some of the ten distinct groups of users that a recent PEW Internet Study discovered when researching the assets, actions and attitudes of Americans toward information and communication technology (ICT).

The ten groups fit broadly into three categories: high-end or “elite” tech users comprising 31% of American adults, medium or “middle of the road” tech users consisting of 20%, and low-level adopters or those with “few tech assets”, accounting for a whopping 49% of American adults.

Elite Tech Users (31% of American adults)

Omnivores 8% - They have the most information gadgets and services, which they use voraciously to participate in cyberspace and express themselves online and do a range of Web 2.0 activities such as blogging or managing their own Web pages.

Connectors 7% - Between featured-packed cell phones and frequent online use, they connect to people and manage digital content using ICTs – all with high levels of satisfaction about how ICTs let them work with community groups and pursue hobbies.

Lackluster Veterans 8% - They are frequent users of the internet and less avid about cell phones. They are not thrilled with ICT-enabled connectivity.

Productivity Enhancers 8% -They have strongly positive views about how technology lets them keep up with others, do their jobs, and learn new things.

Middle-of-the road Tech Users (20%)

Mobile Centrics 10% - They fully embrace the functionality of their cell phones. They use the internet, but not often, and like how ICTs connect them to others.

Connected But Hassled 10% - They have invested in a lot of technology, but they find the connectivity intrusive and information something of a burden.

Few Tech Assets (49%)

Inexperienced Experimenters 8% - They occasionally take advantage of interactivity, but if they had more experience, they might do more with ICTs.

Light But Satisfied 15% - They have some technology, but it does not play a central role in their daily lives. They are satisfied with what ICTs do for them.

Indifferents 11% - Despite having either cell phones or online access, these users use ICTs only intermittently and find connectivity annoying.

Off the Network 15% - Those with neither cell phones nor internet connectivity tend to be older adults who are content with old media.

This study provides a wealth of information for private sector marketing as well as service planning in the public sector. The fact that almost half of adult Americans make little or no use of ICT, demonstrates that service delivery in the public sector cannot exclude traditional methods, such as television, radio, newspapers and telephone. At the other end of the spectrum, however, are the so-called “elite” for whom ICT is a core component of their lives and who expect ICT to provide all the information and services they require.

Some interesting results about demographics, gender and ethnicity were revealed as well. The typical “omnivore” is a young male in his twenties, while the typical “connector” is a female in her late thirties. “Lackluster veterans” are predominantly white, while “omnivores” are an ethnically diverse group. As exposure to broadband, wireless and other information technologies increasingly happens in schools, the more tech-oriented groups tend to be higher-educated. Not surprisingly, the most tech-oriented groups tend to be decades younger than the least tech-oriented groups.

Given the high adoption rate of cell phone use across all categories, one would expect the availability of WAP-enabled websites and web-based services to increase. Conversely, about 15% of adult Americans don’t have a cellphone and never go online. This “off the network” group, who are in their 60’s and older, are likely to live a long time and are the least likely to transition into new technologies.

While the elites are showing the way of the future, there are a significant number of people with few tech assets who will still require traditional methods of service delivery for many years to come.

Blogvertising: Ethics in advertising for bloggers

2007-05-29T12:41:00.001-07:00

Many blogs are using pay-per-click ads to generate revenue and as long as the ads don’t get in the way of the content, most readers don’t really mind. Many bloggers, however, are now providing advertising in the form of paid blog posts that are often disguised as spontaneous product reviews. For the reader, this can be misleading, particularly if the writer doesn’t provide a clear statement to indicate that they are providing a paid review.

For the uninitiated, services such as Pay-Per-Post, Review Me and Sponsored Reviews offer pay to bloggers to post product reviews on their blogs. While it isn’t stated explicitly, the expectation certainly appears to be that the paid posts will be largely positive in tone. Bloggers with high traffic ratings will be paid most, as they obviously have a wider audience. The intent of advertisers is to do more than create good “word of mouth” for their products; they are also looking to drive traffic to their own websites, thereby increasing their own ranking on search engines and thus, ensuring a better hit rate at their point of sale.

So, where’s the harm? I don’t have any issue with bloggers trying to generate revenue through their sites. Blogging can be hard work and time-consuming, so a small pay-off for the time and effort seems fair. It becomes harmful when the blogger has developed a trust relationship with readers and then violates it by not being explicit about the intention of their sponsored posts.

Many bloggers use a disclosure policy and badge, such as those provided at disclosurepolicy.org to inform readers that they earn revenue from advertisers and that they may endorse products in their writing. But this kind of “blanket” disclosure policy is not sufficient if readers have no way of knowing which post is an authentic, unpaid and therefore, unbiased commentary and which is a paid, and probably biased product review.

The ethical approach for bloggers is three-fold:

1. If you are planning to introduce advertising and paid reviews to your blog, write a post about it so you inform your readers up-front. If you have been developing a following and a trusted relationship with your readers, you owe it to them to be honest.
2. Post a disclosure policy. If your approach to revenue generation changes, be sure to update your policy accordingly.
3. Provide a disclosure statement at the start of each and every paid post, such as “This is a paid review”. It is unethical to omit the statement and very misleading to leave it as a “gotcha!” at the end of the post.

If you’re an interesting blogger with a reputation for being honest with your readers, they will tolerate the occasional paid post, as long as you’re up-front about it. If you’re not, readers will eventually get wise and move on.

Photos of the new Arivaca Tower

2007-05-27T13:52:00.001-07:00

J. Otto Pohl at Otto's Random Thoughts has a link to photos of the Arivaca Tower, which was constructed in just a few days this week. (For the background on this story, please read the following series of posts: SBI#1, SBI#2, and SBI#3.)

The tower is not yet operational, but local citizens are planning to thwart all of the cameras, radar and GPS technology by making full use of recreational land in the immediate vicinity of the tower.

Just a mile and a half from Main Street, it's a perfect place to hike, bike, birdwatch, target practice, picnic, and hold drumming ceremonies on the sacred space it abuts. Let's have some fun!

It will be interesting to see what impact this form of protest will have on the tower's effectiveness in preventing illegal border crossing.

My selections for the Thinking Blogger award

2007-05-25T21:47:00.000-07:00

I was selected the other day by Theresa at Sleeping Kitten –Dancing Dog for a Thinking Blogger award. Theresa was recently awarded one herself for writing so eloquently on topics ranging from childhood memories to respecting one’s parents to pride and anger.

The Thinking Blogger meme was started by Ilker Yoldas at The Thinking Blog, with the premise “Too many blogs, not enough thoughts!”. I’m very honoured that Theresa thought that what I’m writing here is thought-provoking, as this blog was intended as a place for me to explore ideas, document my research and hopefully engage others in discussion. I’m pleased to accept the award and pay it forward to five other bloggers because I would like to promote those who think before they write, who do some research, who explore and who ask provocative questions.

In nominating these five*, I want to make it clear that none of them are under any obligation to accept the award, link back to me or to carry on the meme; this is simply an opportunity to point others to blogs that I respect and have come to read regularly:

Adam at One-eyed View – A thought-provoking blogger, writing on everything from technology to politics to the environment to social issues to censorship and popular culture.

Johno at Graphic Design Art and Typography Blog - Explores all of these topics and more. An attractive blog that is also insightful and engaging.

Diamond VVV1 at MyBootsnMe – Exploring regional parks in and around the Vancouver, British Columbia area, with beautiful photos, thoughtful reflections and a style that brings the area to life for the reader.

David at smallSHIFT - This new blog is built around the belief that technology in the hands of passionate users can inspire change, empower individuals and make a difference. This is one to watch.

Stephen at Don’t Trip Up - Extremely well-researched and in-depth analysis of British politics and current affairs, with a centre-left perspective.

I hope you’ll drop by these blogs and see for yourself why they are deserving of the “Thinking Blogger” award.

-----

*Should you choose to participate, please make sure you pass this list of rules to the blogs you are tagging.

The participation rules are simple:

1. If, and only if, you get tagged, write a post with links to 5 blogs that make you think,
2. Link to this post so that people can easily find the exact origin of the meme,
3. Optional: Proudly display the 'Thinking Blogger Award' with a link to the post that you wrote (here is an alternative silver version if gold doesn't fit your blog).

Unmanned drones secure U.S. borders

2007-05-24T00:07:00.000-07:00

It seems the more I read about the U.S. Secure Border Initiative, the less I want to know.

In addition to the networks of towers with radar, video cameras and GPS tracking, Homeland Security will be patrolling sections of the Canadian border with unmanned drones. The Unmanned Aircraft Systems (UAS), known as the MQ-9 Predator "B" or the "Reaper," is a significantly improved version of a variation of the MQ-1 Predator used by the U.S. Air Force in Afghanistan and Iraq. The first will be deployed along the border between North Dakota and Manitoba before the end of 2007.

While fewer than 10,000 people were detained for entering the U.S. illegally via Canada in 2004, U.S. officials are concerned about drug smuggling, terrorist risks and the smuggling of Asian migrants via the northern border.

"What we are looking to build is a virtual fence, a 21st-century virtual fence,"
U.S. Homeland Security Secretary Michael Chertoff said.

In 1987, U.S. President Ronald Reagan stood at the Brandenburg Gate in Berlin and admonished Soviet leader Mikhail Gorbachev to “tear down this wall”. Thirty years later, a virtual wall of surveillance is being constructed along the 49th parallel.

Local Reaction to the Arivaca Tower and SBInet

2007-05-20T23:25:00.000-07:00

Imagine the government is planning to build a 98 foot (30 metre) tower on the edge of your small town, where guards monitoring the adjacent national border will use radar and live video streaming to transmit the images and GPS locations of people crossing the border illegally to the laptops of guards waiting on the ground. At any time in this rural area, a 130 decibel "hailer-horn" could sound, disrupting the peace of your day, startling horses and their riders and scattering local birds and wildlife. Twenty-four hours a day, seven days a week.

This is the reality facing the residents of Arivaca, Arizona, the town which will serve as the pilot project for U.S. Homeland Security’s Secure Border Initiative or SBInet. The tower is scheduled to be erected this week. I wrote a few days ago about the privacy concerns this may raise for Canadian and Mexican citizens living near the U.S. borders and the proposed network of 10,000 kilometres (6,213 miles) of towers. J. Otto Pohl, a resident of Arivaca who has been writing about the tower in his blog Otto’s Random Thoughts pointed me to several local articles about the tower and the reaction of local residents. This is an enormous intrusion in their lives and they have been given very little notice and no real consultation by Homeland Security or Boeing.

What is more discouraging is the tremendous cost and apparent failure of this kind of technology in securing the borders. One year ago, The Washington Post wrote about SBI net and the checkered record of similar kinds of multi-billion dollar surveillance technologies:

If the military could seal a 6,000-mile border for $2 billion, Iraq's borders would have been sealed two years ago," said Andrew F. Krepinevich Jr., executive director of the Center for Strategic and Budgetary Assessments, a defense think tank.

The small town of Arivaca will serve as the proving ground for SBInet and local residents appear to have an uphill battle in ensuring their concerns are heard. Hopefully the amount of international attention given this story will not disappear once the tower goes up.

--------------

Meanwhile, under the Western Hemisphere Travel Initiative (WHTI), Canadians are facing huge line-ups at Passport Offices, as under the new American law every Canadian is now expected to produce a passport when flying across the border and a year from now, in order to cross the border by land. Until recently, a driver’s licence was adequate, particularly for a daytrip of cross-border shopping or visiting family and friends. The United States is implementing the WHTI to increase border security. The initiative stems from the Intelligence Reform and Terrorism Prevention Act of 2004, which is based on the 9/11 Commission Report.

Politicians in Canada and the U.S. have often boasted about sharing the longest, undefended border; those days are about to become a distant memory as a vast network of towers and surveillance equipment is erected along the border over the next few years.

U.S. Border Surveillance Goes High Tech

2007-05-17T16:42:00.000-07:00

A high-tech network of nine surveillance towers in Arizona is the first of many more like it to be erected as part of the U.S.’s Secure Border Initiative, the National Post reported today. Residents of the small town with the dubious distinction of serving as a pilot for this initiative are up in arms about the government’s ability to observe and record every public activity in their ordinary lives.

"It's like Big Brother. It will place the whole town under surveillance," said C Hues, a community activist, as residents gathered for a meeting late Tuesday with customs and border patrol representatives.

"The government will be able to watch and record every movement we make, 24 hours a day. It will be like living in a prison yard," she added.

In 2006, over 1 million people were arrested for illegally attempting to cross the Mexican border into the United States. One of the towers to be constructed just south of the town will be 30-metres (98 feet) high and topped with cameras and radar. Images and video captured at the tower will be streamed live to troupers on the ground, along with GPS coordinates.

The ability to monitor the activities of the residents of one town of 1500 may not be a big concern to many people. But the Secure Border Initiative isn’t limited to the little town of Arivaca, Arizona. Over the next few years, similar networks of towers, with cameras and radar will be constructed along over 10,000 kilometres (6,213 miles) of the Mexican and Canadian borders. Conceivably, hundreds of thousands of residents along the borders of all three countries may come under the scrutiny of these cameras.

It isn’t a stretch to be concerned about how this recorded information could be used, given the recent experience of Andrew Feldmar who was barred from entering the U.S. after a border guard googled his name and didn’t like what he read. The residents of Arivaca, Arizona are fighting the construction of the massive surveillance network in their town and I hope that other Americans will be just as alarmed about this attack on privacy.

In the meantime, how will the Mexican and Canadian governments respond to cross-border surveillance of their citizens? Will our right to privacy be traded away in the name of U.S. national security?

Trendspotting: Patterns in Blog Statistics

2007-05-15T16:08:00.000-07:00

Has anyone else noticed that their blog statistics regularly peak on Tuesdays? For the past six weeks, this has been the trend in my stats and I wondered if it was the result of my own activity, or if there is some predictable pattern occurring across the blogosphere.

Hits to my blog increase steadily over the weekend, peaking on Tuesdays and then dropping off sharply on Wednesdays, only to start the same climb upward all over again.

I wondered if I tend to spend more time on the care and feeding of mybloglog.com and blogcatalog.com at the weekend and if that might be influencing the numbers. But this past weekend, I spent very little time on those two sites and the pattern is exerting itself once again this week.

Could it be that we all lose energy for visiting blogs and Web surfing mid-way through the work-week? Do we tend to visit other blogs and comment more toward the weekend, leading to a "spill-over" effect that peaks on Tuesdays? I’d be interested to hear if others are noticing this trend or even a different one. Any explanations?

I love a good mystery!

Cops want covert cameras in public places

2007-05-11T09:42:00.000-07:00

Police in Victoria, British Columbia want to install security cameras in public areas around the provincial capital in a bid to fight crime and reduce vandalism. I wrote an earlier post about the plethora of surveillance cameras in public areas and motorways in the United Kingdom and the concern that this was creating a “surveillance society” there.

What’s different about the Victoria proposal is that while cameras in the U.K are visible to the public, police in Victoria want the cameras to be hidden. The rationale for hiding the cameras from public view is unclear. Visible cameras are designed to serve as a deterrent to crime, with the criticism that they only serve to move crime along to other areas. Hidden cameras are designed to catch criminals in the act, and could be argued to have a wider impact in deterring crime, as no one knows for sure where the cameras are located and when they are being watched.

Meanwhile, in a six-month pilot project, police in Toronto are extending the use of visible closed-circuit cameras from the downtown into residential areas with high crime.

"Wherever the analysis tells us that violence is likely to take place...those
are the areas we will use the technology," said police chief, Bill Blair.

Back in the U.K, police are building on their massive network of fixed cameras, by carrying camcorders with them on the beat in an increased effort to cut crime and reduce "anti-social behaviour. "

Sgt Craig Donald, of the INA's Safer Community Team, said: "Equipping officers with hand-held cameras has had great success elsewhere with reductions in anti-social behaviour and crime being recorded.

"It's a very effective way to secure evidence to support a prosecution and it's certainly a deterrent as people don't usually want to commit a crime if they think there is a chance they could be identified at a later stage."

The reactions from citizens in every jurisdiction where police surveillance cameras are being used is inevitably mixed. Some support the cameras as they believe they will improve social order and reduce crime, and besides, they’re not doing anything wrong. Others object to the intrusion into their privacy and how the very presence of the cameras may alter their decisions. When cameras are visible, people can at least choose to avoid them. Hidden cameras have a greater chilling effect on the average citizen, as they never know when or where they could be filmed.

What if you’re a gay man who regularly attends a local gay bar? Or, you are a concerned citizen who wants to participate in public protest rally against a police or government decision? Or, you’re seeking medical attention and you don’t want anyone to know about it? Would the presence of visible security cameras, or the threat of being monitored by hidden cameras make you think twice before participating in any of these lawful activities?

While the evidence to support the claims that cameras reduce crime is in dispute, the use of this surveillance technology by police is here to stay and citizens need to be informed about how and why it is being used. Police must be held to the highest standard of accountability to ensure transparency and to ensure that privacy laws are not violated. In our efforts to reduce crime and improve social order, we should not trade away our rights to privacy and to participate fully in society without fear.

So, as you go about your business today - do you really know if you’re being watched?

Shooting the messenger : Taking the Internet to court

2007-05-07T22:04:00.000-07:00

Just for a moment, put yourself in the shoes of these two men:

Case No. 1: You’re just an average guy who meets a nice girl and you begin dating. After a few months, the new relationship sours and you decide to move on. But your ex-girlfriend doesn’t move on. She is angry and decides to warn everyone about you on a website called dontdatehimgirl.com. Using an anonymous username, she posts a photo of you, along with your full name, city and state and writes an invective-laden comment, accusing you of being a herpes-infected homosexual or bisexual, who passed on a sexually transmitted disease, and fathered numerous illegitimate children. You ask the website owner to pull the post, but learn that your only recourse is to post a comment as rebuttal to the offending post. The original post will remain, searchable to anyone who accesses the site, just by looking up your name.

Case No. 2: You’re a prominent businessman, with clients primarily in the legal and judicial profession. You decide to join a fledgling political party and soon become the party’s campaign manager and financier. You make some decisions that aren’t popular with some of the party members and they use websites such as Wikipedia and P2Pnet to criticize your decisions. But some go further, posting anonymous statements which you maintain are untrue and which you fear will seriously damage your professional and political reputation. You ask the site hosts to remove the offending posts, but they are either unable or unwilling to comply with your requests, or they do not comply quickly enough.

What would you – what could you – do next? Ignore the posts? Put up your own website to refute the libelous statements against you? Try to track down the anonymous posters and sue them? Or, sue the site hosts?

In both cases, the men at the centre of these attacks decided to fight back in court by suing the site hosts.

In the first scenario, Todd Hollis took the owner of website dontdatehimgirl.com, Tasha Cunningham to court for allowing the posts in the first place and for refusing to pull them down. (Shout out to one-eyed view for bringing this site to my attention. He has an interesting post about it here). The factors leading to the judge’s decision to dismiss the case were not about the damage that may have been done to the plaintiff, nor about the fact that Ms. Cunningham is merely the messenger, not the originator of the message. The decision was made based on old-fashioned jurisdictional law: because the website originates in Florida and the lawsuit was filed in Pennsylvania, it was determined, through statistics from the site’s on-line shop, that few people in Pennsylvania would have seen the site. Therefore, the contacts in Pennsylvania were limited. It seems the door is open for Hollis to re-file his suit in Florida. In the meantime, he is planning to sue the woman who anonymously made the posting, which remains to this day on dondatehimgirl.com.

In the second scenario, Wayne Crookes decided last month to file suit against three sites: Google, P2Pnet.net and openpolitics.ca. Because Crookes is Canadian, this case has been filed in British Columbia, Canada. In a recent interview with the Globe and Mail, Crookes says that he is holding the site hosts responsible for the offending anonymous posts:

"I hope that the outcome is that people will realize they have obligations
and that they will be forced to accept responsibility for their actions. The
larger the organization, the greater the expectation that they will be held
accountable for their actions."

Both of these cases have wide implications for site hosts, free speech and anonymity.

Already, the Wikipedia article about Wayne Crookes has been all but expunged to the point that it is challenging to find the posts which ignited the lawsuit in the first place. What chilling effect will this particular lawsuit and others like it have on site hosts, as the laws vary from one jurisdiction to another?

Will more individuals feel less inclined to put their names to posts, even if they strongly feel they are serving a wider public good? Should there be a looser set of criteria for libel if one is a public figure, working in the public trust, such as Mr. Crookes, versus a more rigorous standard for the average citizen, like Mr. Hollis?

Anonymity on the internet is essential to giving a voice to those who might otherwise be silenced. We don’t all live in truly democratic nations, and the Internet is a global community. Even in Western democratic nations, whistleblowers still need extraordinary protections if they choose to go public.

It will be interesting to follow these two cases on both sides of the border – one private citizen, one public figure. How will the judges decide what is more important – the greater good, or the rights of the individual? The odds seem to favour the greater good, which will likely be small comfort to Mr Hollis and Mr. Crookes.

Just put yourself in their shoes.

Yes, I am a librarian!

2007-05-05T20:28:00.000-07:00

Evelyn: Look, I... I may not be an explorer, or an adventurer or a treasure-seeker, or a gunfighter, Mr. O'Connell, but I am proud of what I am.

Rick: And what is that?

Evelyn: I... am a librarian.

From The Mummy (1999) starring Rachel Weisz and Brendan Fraser

I get some of the most interesting reactions when I tell people that I am a librarian. The most common is “You don’t look like a librarian!”. Oops, sorry, I guess I left my bun and horn-rimmed glasses at home tonight. The second most common reaction is “Oh, so you must really like to read” or – my favourite – “It must be nice to get paid to read books all day”. The most interesting reaction was when I told one of my new neighbours that I had worked as a library manager. Her response was similar to that of someone spitting a mouthful of coffee when they've heard something shockingly funny, then she looked embarrassed and stammered: “I’ve never actually met a librarian before!”.

Well, I certainly didn’t become a librarian for the prestige or the glamour. I decided to become a librarian because I had always enjoyed being in libraries and immersing myself in the world of ideas. All that knowledge that could just be pulled off the shelf to read, and to take home – for free! I liked the idea of teaching people and helping them learn, of being the person who knew just what you were looking for and just where to find it. It was the late 80’s when I decided to do a Master’s degree in Library and Information Science, so there was no Internet, not a lot of people had computers in their home (although my Dad bought me and my brother a Commodore VIC-20 way back in 1981!). When I graduated, I was sure that I would be working at the information desk in a public library in a large urban centre somewhere, getting to know the regular customers and their interests, hearing about their families, and generally becoming part of the local community.

It didn’t exactly work out that way, as cutbacks in the public sector in the early 90’s meant there were very few jobs in public libraries. So my career, like many librarians I know, has been decidedly unconventional. Although, unconventional is probably the way most librarians would describe their jobs anyway!

So, to help conquer the stereotype, here is my list of Things You Wouldn’t Think a Librarian Would Do (but I’ve actually done all of these in my library career!):

1. Interview a panel of architects for a new building design
2. Work with a team to develop a handicapped accessible high school library
3. Teach Boolean logic and other search skills to teachers
4. Work with a lawyer to develop a major systems contract
5. Implement a media management system
6. Work as a systems analyst
7. Write software training documentation
8. Manage millions of dollars in budget
9. Implement an electronic document management system
10. Write Requests for Proposal for large-scale projects
11. Test barcode readers for elementary schools, with the assistance of a group of third graders
12. Know the difference between CODABAR and CODE39 barcodes (sad, but true)
13. Investigate RFID technology
14. Oversee the implementation of Self Service Check-out technology

Seventeen years after graduating with an MLIS, I’ve had a very different career than I expected I would, in fact, it seems I’ve had about 3 careers so far. But it’s all been interesting and the qualities that attracted me to librarianship in the first place – curiosity, finding and organizing information, sharing ideas, helping people – have all been essential skills in my career.

So, like Evie Carnahan, I am proud of what I am. Yes, Mr. O'Connell, I ... am a librarian.

Government Bans Facebook … but MySpace is still okay

2007-05-03T22:47:00.000-07:00

Employees with the Ontario government who tried to log in to their Facebook accounts this morning were met with an “access denied” message. Even most members of parliament and cabinet ministers have been blocked from Facebook, which joins a list along with online gambling and porn sites. The ban took everyone by surprise, including Public Infrastructure Minister David Caplan, one of the few cabinet ministers with a Facebook page.

The rationale for the ban was rather vague:

"The staff determined it's not as directly related to the workplace as we'd like it to be so we're restricting access to it," Government Services Minister Gerry Phillips told the Toronto Star.

"Our IT (information technology) people are pretty broadly familiar with the marketplace and they said, `Here's a website that's going to be increasingly more popular for the OPS (Ontario public service). Is this an appropriate website to be spending time on?'" he said.

"It's the ministry making these decisions on trying to ... restrict access to ones that are inappropriate and then to anticipate where one may grow in popularity and we may end up with a lot of OPS time being taken (up) on it."

When even the Canadian Prime Minister has a page on Facebook, it obviously is considered an important way for politicians to get their message out. Any employer has the right to restrict the sites that employees access from employer networks and governments are accountable to taxpayers for ensuring that employees are productive on the job. Most public sector employers have policies in place which outline appropriate use of the Internet, and in many cases, employees are required to sign a document that goes into their permanent record.

The vague rationale for this ban and the fact that other social networking sites, including MySpace, are still accessible to government employees and ministers does raise questions. One has to wonder if the Ontario government was really concerned about the amount of time that employees and elected officials were spending on Facebook or if they were actually more concerned about what information might be shared on a popular public forum.

Either way, it seems that it will become increasingly difficult for employers to stay on top of the many ways that employees can become distracted by online activities from the work they’re paid to do. In the meantime, I suspect many employees will move along to MySpace or other social networking sites … until the Ontario government denies access to those as well.

Facebook: Student lessons on libel

2007-05-01T11:37:00.000-07:00

Some students in Toronto are getting a primer on libel and ethics this week, as they were banned from a class trip as punishment for making false accusations about a teacher on Facebook. In the most recent incident, a group of Grade 8 students jokingly accused a teacher of masturbating in class. There have been two similar incidents in Ontario in recent months, according to this Canadian Press story:

"The principal implemented our progressive discipline policy, and so no, there are no new developments," Robert Dunn, superintendent of the York Region District School Board, said when asked if the punishment was being re-thought. The action follows two other recent high-profile incidents in the province.

Five teenagers were suspended last month from Toronto's Birchmount Park Collegiate for writing inappropriate remarks about staff. In February, 19 students who blamed their principal for school policies on cellphone use, and took their gripe online, were suspended from Robert F. Hall Catholic Secondary School in Caledon East, northwest of Toronto.

Part of the problem may lie in the expectations students have of the Internet. "Kids don't think of those places as public places," said Annie Kidder of the group People for Education. In a recent Ipsos-Reid poll conducted for Microsoft Canada, 70 per cent of respondents aged 10 to 14 said they believe the information they put online is private.

It is clear that the line between private and public is blurring as people increasingly use social networking technologies to share their most intimate thoughts and ideas. In the most recent case, a teacher’s reputation and career could have been put on the line as his name was associated with inappropriate conduct on the job, whether done jokingly or not. According to Canadian Defamation Law, these kinds of false accusations certainly seem to fit the interpretation of libel. From Duhaime Law (emphasis in italics are mine):

Defamation was well described in a 1970 British Columbia Court of Appeal decision called Murphy v. LaMarsh: (Defamation is where) a shameful action is attributed to a man (he stole my purse), a shameful character (he is dishonest), a shameful course of action (he lives on the avails of prostitution), (or) a shameful condition (he has smallpox). Such words are considered defamatory because they tend to bring the man named into hatred, contempt or ridicule. The more modern definition (of defamation) is words tending to lower the plaintiff in the estimation of right-thinking members of society generally.

The major points of defamation law in Canada are as follows:
- Defamation is a "strict liability" tort. In other words, it does not matter if the defamation was intentional or the result of negligence. Defamatory material is presumed to be false and malicious. "Whatever a man publishes", according to one case, "he publishes at his peril."
- Defamation must be a direct attack on an actual reputation, not an alleged reputation that a "victim" believes they deserve. A judge will assess the statement against the evidence of the victim's reputation in their community.
- The remarks must be harmful (i.e. "defamatory") and this will be assessed on a case-by-case basis. Some statements are clearly defamatory. Other statements would only be defamatory to the person targeted by the remarks. What may be a nonsensical or mildly offensive remark to one person may constitute serious defamation to another. The judge will consider the situation of the person defamed in assessing the claim of defamation.
- The defamatory remark must be clearly aimed at the plaintiff. General, inflammatory remarks aimed at a large audience would not qualify as the remarks must be clearly pointed at a specific person.
- The defamatory remarks must be somehow conveyed to a third party. Private defamation just between two parties causes no reputation damage to reputation because there are no other persons to be impacted by the remarks. With libel, the damage is presumed as it is published.

Posting these kinds of accusations on Facebook or in a blog is no different from publishing them in a book or a newspaper. So, I think that teaching administrators are taking the right approach by suspending the privileges of students who make these kinds of false accusations, in order to help them and other students understand the seriousness of their actions and the potential consequences to individuals who are the target.

In Canada, teacher-librarian associations have been advocating for over a decade for an Information Literacy curriculum to provide students with the knowledge and skills to understand the opportunities and risks of web-based information. Students need to understand their rights to free speech, as well as their legal obligations, and based on these incidents, they need it early.

2K Bloggers: Anonymous Blogging

2007-04-29T13:45:00.000-07:00

As a follow-up to my previous post, I highly recommend Elaine’s excellent post over at 2K Bloggers:

The EFF (Electronic Frontier Foundation) suggests these six things you should do to be anonymous: Use a Pseudonym and Don’t Give Away Any Identifying Details, Use Anonymizing Technologies, Use Ping Servers, Limit Your Audience, Don’t Be Googleable, Register Your Domain Name Anonymously. But there’s more you can do, too... Read the rest of Elaine's post here.

Some great tips for those who are concerned about the potential risks of blogging on sensitive topics.

Google Search Blocks Canadian's Entry into U.S.

2007-04-26T10:22:00.000-07:00

An alarming report from Tuesday’s Globe and Mail:

Nearly 40 years ago, a young psychotherapist embraced two-thirds of LSD guru Timothy Leary's advice to the Sixties generation to "turn on, tune in and drop out." Curious how LSD and other hallucinogens might be used in treating patients, Andrew Feldmar turned on and tuned in himself. But he never dropped out. And, no fan of the late Dr. Leary, Mr. Feldmar took his last hit of acid in 1974.
Thirty-two years, however, turned out to be but an instant in the long, unrelenting U.S. war on drugs. Last summer, in an incident that has just come to light, Mr. Feldmar, now 66, was banned from entering the United States because of his long-ago use of LSD. Because Mr. Feldmar had never been charged with possession of the once-popular illegal drug, privacy advocates are even more alarmed by the way U.S. border guards at the busy Peace Arch crossing near Vancouver found out about it.

The guards simply looked up Mr. Feldmar on the Internet and discovered his own article about using LSD, written for the scholarly, peer-reviewed journal Janus Head.
Eugene Oscapella, an Ottawa lawyer involved in privacy issues for 20 years, said the incident sends a frightening message to Internet users, particularly those who bare their souls online. "Don't ever put anything about any illegal activity on the Internet," Mr. Oscapella warned yesterday. "It leaves a digital footprint for all to see, and it's there forever. "We've gone beyond Orwellian measures. The state can now do things with a flick of the switch that used to be incredibly labour intensive."

In an earlier posting, I discussed the many risks that bloggers take in exposing personal information on the Internet with respect to employment and personal relationships. What’s most shocking about this incident is that Mr. Feldmar has never been convicted of a criminal offence and has crossed the border into the United States numerous times without issue. More disturbing than the power that border guards seem to wield is the fact that Mr. Feldmar felt compelled out of fear to sign a confession:

Mr. Feldmar was held at the border for five hours, before being allowed to return to Canada after signing an admission that he had once violated the U.S. Controlled Substance Act. He said he signed out of fear that he might be kept in custody even longer if he refused.
Willie Hicks, public affairs officer for the border crossing, said yesterday that Mr. Feldmar admitted violating U.S. drug laws "in a sworn statement. "I don't make the laws. That's the policy, and we enforce the laws at the border. It is up to the discretion of our officers who gets to go across."

A major blow to free speech and another reason to think twice before putting any of your personal information on the Internet.

The 7 Laws of Identity: User control in system design

2007-04-25T09:21:00.000-07:00

As the level of fraudulent activity online grows, consumer confidence in e-commerce is increasingly threatened. In response, Kim Cameron, Chief Identity Architect at Microsoft developed the 7 Laws of Identity, in cooperation with a number of leading experts from around the world. At the recent Privacy and Security Conference in Victoria, British Columbia, Ann Cavoukian, Information and Privacy Commissioner of Ontario, presented a white paper proposing privacy-embedded laws of identity, based on Cameron’s 7 Laws.

The proposal would create an identity layer in software and web services. Programmers are urged to embed privacy capabilities based on the following seven laws:

Law #1 – User Control and Consent
The user must have control over how much information to provide and under what circumstances.

Law #2 – Minimal Disclosure for a Constrained Use
The user must only provide the least amount of information for a specific purpose.

Law #3 – Justifiable Parties
The disclosure of personally-identifiable information is limited to only those parties that have reason to require it in order to fulfill a specific purpose.

Law #4 – Directed Identity
Web sites and other technology should be unidirectional and shouldn’t be able to access your personal information without your prior consent.

Law #5 – Pluralism of Operators and Technologies
Systems should ensure that users can decide how much personal information to provide, depending upon the context. A “one size fits all” solution is not desirable where your personal information is concerned.

Law #6 – Human Integration
The ways in which users interact with systems must be done in a way that ensures users can more easily detect fraudulent websites and messages.

Law #7 – Consistent Experience Across Contexts
Systems are designed with standards and conventions that are easily recognizable to users, while allowing the user to exercise control between contexts.

More and more of our personal information is accessible than ever before and most of is controlled by others, in both the private and the public sectors. As more of our routine tasks and commerce take place on the Internet, the 7 Laws of Identity are a means for users to take back control of their personal information.

Google-DoubleClick Merger Privacy Threat

2007-04-23T15:05:00.000-07:00

From Reuters:

Consumer privacy groups on Friday sought to derail Google Inc.'s $3.1 billion deal to buy online ad supplier DoubleClick Inc., filing a complaint with U.S. regulators to block the merger on privacy grounds.

Groups led by the Electronic Privacy Information Center have filed the complaint with the U.S. Federal Trade Commission arguing the merger would violate agreed limits on how much data advertisers collect on consumers and seeking an injunction.

"Google's proposed acquisition of DoubleClick will give one company access to more information about the Internet activities of consumers than any other company in the world," the complaint by the privacy activist groups argues.

DoubleClick provides graphical ads from corporate marketers on thousands of sites across the Web. With the proposed merger, Google would emerge as an even more powerful force in the online ad market. Both Google and DoubleClick are denying that their data tracking capabilities would also be merged.

EPIC, along with the CDD (Centre for Digital Democracy) and US PIRG (Public Interest Research Group) are concerned about Google’s ability to record, analyze, track, and profile the activities of Internet users with data that is both personally identifiable and data that is not personally identifiable. The complaint urges the Federal Trade Commission to require Google to present a public plan to comply with well-established government and industry privacy standards such as the OECD Privacy Guidelines. The OECD guidelines include a fundamental principle of openness:

There should be a general policy of openness about developments, practices and
policies with respect to personal data. Means should be readily available of
establishing the existence and nature of personal data, and the main purposes of
their use, as well as the identity and usual residence of the data
controller.

EPIC led the move in 2000 to prevent DoubleClick from automatically combining data from a national marketing database it had acquired and its own anonymous data collected from the computers of Web surfers. DoubleClick eventually backed down and provided users with an “opt-out” option.

Corporate mergers of this type are a serious threat to privacy as search histories and web site visits could be combined, allowing an individual's activities to be tracked across a wide range of websites. In the U.S., the only law that specifically regulates privacy applies to children under the age of 13. EPIC is urging strong privacy legislation, similar to that in the EU and in Canada.

Happy Earth Day

2007-04-22T00:21:00.000-07:00

Off-topic for a bigger cause today... to celebrate, here are some of DivineCaroline's 50 Green Tips for Earth Day and Beyond. As a librarian, I especially want to endorse Tip # 14!

1. Lower your thermostat. Buy a programmable thermostat.
2. Reuse your water bottle. Avoid buying bottled water. In fact, reuse everything at least once, especially plastics.
3. Check out your bathroom. Use low-flow faucets, shower-heads, and toilets.
4. Start a compost in your back yard or on your rooftop.
5. Buy foods locally. Check out Eat Local Challenge and FoodRoutes to get started. Buy locally made products and locally produced services.
6. Buy in season.
7. Buy compact fluorescent light bulbs. You'll find more on energy-efficient products and practices at Energy Star.
8. Turn off lights and electronics when you leave the room. Unplug your cell phone charger from the wall when not using it. Turn off energy strips and surge protectors when not in use (especially overnight).
9. Recycle your newspapers.
10. Car pool. Connect with other commuters at eRideShare.
11. Consider a car sharing service like Zipcar.
12. Ride a bike.
13. Walk, jog, or run.
14. Go to your local library instead of buying new books.
15. At holidays and birthdays, give your family and friends the gift of saving the earth. Donate to their favorite environmental group, foundation, or organization

Read more tips. Small changes add up to a big difference!

12 Tips to Prevent Identity Theft

2007-04-20T09:33:00.000-07:00

Identity theft is becoming an increasing problem, with over 160,000 cases reported in the U.S. in 2002 and over 7,000 that year in Canada. So much of our personal information is available in the cards we carry in our wallets, credit card receipts, bank statements and utility bills that it is easy to be careless and place our finances, personal property, credit history and reputation at risk.

Here are some tips from Safe Canada to protect yourself from identity theft:

Sign all credit cards when you receive them and never lend them to anyone.

Cancel and destroy credit cards you do not use and keep a list of the ones you use regularly.

Carry only the identification information and credit cards that you actually need. Do not carry your social insurance card (Canada) or social security card (United States); leave it in a secure place. This applies also to your passport unless you need it for traveling out of country.

Pay attention to your billing cycles and follow up with your creditors and utility companies if your bills do not arrive on time.

Carefully check each of your monthly credit card statements. Immediately report lost or
stolen credit cards and any discrepancies in your monthly statements to the issuing credit card company.

Shred or destroy paperwork you no longer need, such as bank machine receipts, receipts from electronic and credit card purchases, utility bills, and any document that contains personal and/or financial information. Shred or destroy pre-approved credit card
applications you do not want before putting them in the trash.

Secure personal information in your home or office so that it is not readily accessible to others, who may have access to the premises.

Do not give personal information out over the phone, through the mail, or over the
Internet unless you are the one who initiated the contact and know the person or
organization with whom you are dealing. Before you share such information,
ensure that the organization is legitimate by checking its website to see if it
has posted any fraud or scam alert when its name has been used improperly, or by
calling its customer service number listed on your account statement or in the
phone book.

Password-protect your credit card, bank, and phone accounts, but do not keep a written record of your PIN number, social insurance or social security number, or computer passwords where an identity thief can easily find them. Do not carry such information in your purse or wallet.

Order a copy of your credit report from the major credit reporting agencies at least once every year. Check with the credit bureaus to see whether there is a charge for this service. Make sure your credit report is accurate and includes only those activities that you have authorized.

I would also suggest that you never allow sales staff to put your receipt in the bag; it’s too easy to forget it, toss the bag and your credit card information along with it.

Also, never leave your signed credit card receipt on the table in a restaurant when you leave; always ensure that you hand it directly to your server before leaving the restaurant. Ideally, you should accompany the server when he or she swipes your credit card to ensure they are not “double-swiping”. Embarrassing, yes, as it implies you don’t trust the server, but most good restaurants should appreciate their customers’ concerns.

Identity theft can be a nightmare for the consumer. Start following these tips today to protect your identity.

For more information:

In Canada: Safe Canada

In the U.S.: Federal Trade Commission

In the U.K.: Home Office

Was your privacy breached today?

2007-04-18T11:32:00.000-07:00

Consider these scenarios:

Your new husband’s ex-wife, who works for a medical office, looks up your medical records.

The mail delivery cart in a government office is left unattended in a public area while the mail clerk takes a coffee break.

You drop by your boss’s office to update her on your project and notice a disciplinary report on her desk, with the name of a fellow manager showing prominently on the front page

You open your annual pension plan update and discover someone else’s report is in the envelope instead of your own

A major retailer discovers that their network has been hacked, with potentially hundreds of thousands of customer credit card numbers accessed

Your friend in the benefits department tells you at lunch that a co-worker and mutual friend has been submitting claims for visits to a psychiatrist for the past several months.

Which of these scenarios would you consider to be a privacy breach? If you answered all of them, you would be right. According to Canadian privacy legislation, data that is collected or disclosed without authorization is considered a privacy breach. It doesn’t matter that the breach was overt, inadvertent or accidental; the consequences and implications are equally severe.

Security is a means to achieve privacy. Security is established through rigid policies and procedures, a code of ethics and regular training for staff. Security is also established on the information technology side by restricting data access to only those who need it. For example, the government health minister, responsible for overseeing policy direction for his jurisdiction does not require access to citizen health records to do his job, while a clerk responsible for verifying medical claims does require access to those records. While one might expect the health minister to understand the importance of ensuring the privacy of medical records, it is the staff member who actually accesses the records who is in most need of training. And often, these front-line staff are the least-trained in the organization, yet they have the greatest potential to cause a security breach, the majority of which will be accidental or inadvertent.

Organizations need to ensure that the staff who assume the greatest risk through their exposure to confidential information receive annual training about their obligations with respect to privacy legislation and the potential consequences of a privacy breach. Organizations also need a clear set of policies and procedures for dealing with privacy breaches.

Organizations need to ensure that their I.T. departments have adequate budgets to ensure regular upgrades to hardware and software, as well as regular training for their staff.

Governments also need to strengthen privacy legislation to ensure that organizations are accountable to the public in the event of a privacy breach. In the case of the recent TJ Maxx hacking, for example, most U.S. states and Canadian provinces had no legal requirement for the retailer to inform customers that their credit card data had been compromised. Monday's session at the Prairie health information privacy conference highlights the ongoing challenge that privacy breaches, inadvertent or otherwise, present to the public and private sector.

So think back on where you were today – where you work, where you shop, where you ate lunch, where you live – do you know if your privacy was breached today?

The future of privacy: lots of questions, no real answers

2007-04-16T11:05:00.000-07:00

We live in a world where being connected and available 24/7 is taken for granted. Was I really born into a world where you drove around looking for a payphone and then hunted for a dime to make a call? Did I once really own one of those huge brick car phones? I remember at 15, my best friend taking me to her bank machine - the first and one and only for several years in my little hometown - and showing me how she could get money from the bank anytime she wanted. Amazing! Fast forward a few decades and if you're a teenager or college student and you're not on Facebook, well, you don't exist. Reality TV promises everyone 15 minutes of fame. Or you can join the masses and start a blog. Or set up shop in Second Life. It's not that we are ghosts in the machine; we are not real unless we are in the machine. It's all happened so fast.

This desire to be visible, to have a presence in a virtual space, is more than a bit unsettling to me. We all have ideas to share and questions to explore, that's why I started this blog. It is a research space for me to ask questions, to try to answer them, and to hopefully hear the thoughts of others on the topic. This makes sense to me and seems to have limited risk. What I find most unsettling is the way that many blogs and social networking sites encourage the individual to introduce all aspects of their personal life and most intimate thoughts into the public realm. It seems an enormous risk in a world where most Hollywood celebrities (Britney and Paris excepted, of course) are desperately trying to preserve the privacy of their personal lives.

A recent careerbuilder.com survey published Oct. 26, 2006, reported that "26 percent of hiring managers use search engines to check on potential hirees. Half of the manager respondents said they dismissed job candidates based on what they found using a search engine. Sixty-three percent crossed a candidate off their lists because of what he or she had put on a social networking site." Whether or not this is a fair or ethical approach for hiring managers to take is debatable: the fact is that individuals are willingly making more personal information available about themselves in a public forum than has ever been available historically. In what other ways could this information be used? By prospective romantic partners? By insurance companies? And how long will this information be "out there"? What control does one have once the information is published on the Web?

One could argue that adults need to be aware of the potential risks of what they post and consider the consequences. But what about those who share the personal information of others without their informed consent? Dooce's posts include a monthly hommage to her daughter Leta, which include photos, as well as many blog entries documenting her bowel habits. How will Leta feel about this when she's older? Will she consider it a violation of her privacy? Or, will she, along with the rest of her generation growing up in the spotlight of Mommy blogs and Facebook and MySpace not really differentiate between what should be public and what should be private?

The blurring of public and private is a disturbing trend, with potentially devastating consequences: so why do people feel compelled to "show-and-tell-all" online? That's for another post.

Smile... you're on Candid Camera

2007-04-04T09:46:00.000-07:00

…and pick up that rubbish, mate!

From Reuters:

Britain will fit more surveillance cameras with loudspeakers allowing security staff to berate people spotted dropping litter, fighting or vandalizing property, the government said on Wednesday. Home Secretary John Reid hopes the talking cameras -- which have been on trial around the country -- will help cut crime. But critics say the idea is another lurch towards Britain becoming a ``surveillance society.'' …``Talking CCTV is another tool in creating safer communities,'' Reid said in a statement. ``It uses modern technology to allow camera operators to speak directly to people on the streets to stop or prevent them acting anti-socially.'' Louise Casey, a civil servant who co-ordinates the government's Respect campaign to tackle bad behavior, said people could ``face the shame of being publicly embarrassed.''

Britain is the most watched country in the world, with an estimated 4.2 million CCTV cameras, or one for every 14 people. As a result, surveillance has emerged as a thriving industry in Britain, where many residents seem eager to trade personal privacy for the perception that the cameras reduce crime and other anti-social behaviours. CCTV cameras are everywhere in Britain: the workplace, motorways, public squares and gathering areas, and many are choosing to install them inside their own homes. According to Privacy International:

CCTV is very quickly becoming an integral part of crime control policy, social control theory and 'Community consciousness'. It is promoted by police and politicians as primary solution for urban dysfunction.

But do these cameras really work, or do they just move the problems along to areas where there is no surveillance? Many dispute the statistics provided by law enforcement agencies and argue that the cameras are typically placed in “high-rent” districts and displace the criminal activities into more “low-rent” areas.

In addition to more public CCTV cameras, the Blair government is also planning to issue national identity cards with a corresponding database of personal information. No wonder even the UK's Information Commissioner has labeled Britain a “surveillance society”.

GMail Paper .... for some, it's no joke

2007-04-02T11:52:00.000-07:00

I’m not sure how long this link will be available, but the gist of Gmail Paper is that you can click and print as much as you want on-line and Google will sort your print-outs and deliver them directly to you so you can have the satisfaction of maintaining a paper trail:

Everyone loves Gmail. But not everyone loves email, or the digital era. What ever happened to stamps, filing cabinets, and the mailman?
Well, you asked for it, and it’s here. We’re bringing it back.
A New Button
Now in Gmail, you can request a physical copy of any message with the click of a button, and we'll send it to you in the mail.
Simplicity Squared
Google will print all messages instantly and prepare them for delivery. Allow 2-4 business days for a parcel to arrive via post.
Total Control
A stack of Gmail Paper arrives in a box at your doorstep, and it’s yours to keep forever. You can read it, sort it, search it, touch it. Or even move it to the trash—the real trash. (Recycling is encouraged.)
Keep it Secret, Keep it Safe
Google takes privacy very seriously. But once your email is physically in your hands, it's as secure as you want to make it.

Google’s April Fool’s day joke is hardly a laughing matter for those of us responsible for an organization’s document management. Truth is, many of us are as addicted to paper as we are to e-mail, IM and our cellphones. This issue surfaced last week, when I was reviewing the status of paper records with staff at work, along with some reps from the company that provides the electronic document and record management system (EDRMS) that we will be implementing. Apparently, staff had been discussing the new system and many assumed that we would just continue to retain the paper versions in addition to the electronic copies on the EDRMS.

The fact is that many people are just not comfortable with the seemingly ephemeral quality of electronic documents which they feel could be too easily deleted or “lost”, while somehow the paper copy provides a sense of “permanence”. This, despite the fact that paper documents can easily be misfiled, lost, destroyed or altered, yet it seems the ability to hold something tangible and “real” in the hand provides a false sense of security that the electronic document cannot.

In British Columbia, the Electronic Transactions Act provides the framework for the acceptance of electronic documents in lieu of the original paper copy if:

- there exists a reliable assurance as to the integrity of the record in
electronic form, and;
- the record in electronic form is accessible by the person to whom it is provided and is capable of being retained by that person in a manner usable for subsequent reference.
- if there exists a reliable assurance as to the integrity of the record … i.e. the record has remained complete and unaltered, apart from the introduction of changes that arise in the normal course of communication, storage and display
- on provision or receipt of the record, the information, if any, that identifies the origin and destination of the record and the date and time when it was sent or received is also retained.

These standards serve to ensure the reliability and integrity of the electronic version of the document. The challenge is to build these standards into the EDRMS and to ensure that system backups are secure and redundant. Then it becomes a matter of educating employees so that they can let go of their “security blanket” and have the same level of confidence with the electronic document as they do with the paper version.

Sadly, I suspect that if Google were serious about offering the GMail Paper service, they would be flooded with customers ...

Big Brother Bill

2007-03-30T09:45:00.000-07:00

It seems the Conservatives are in agreement with the Liberals for once, but unfortunately, it's not on the environment, or day care, but a bill that will introduce sweeping new surveillance powers to law enforcement agencies. Canadian Prime Minister Stephen Harper says his government should adopt Bill C-416, in order to make good on its law and order agenda. Liberal MP Marlene Jennings introduced the private member's bill on intercepting new communications technology to crack down on crime and it has already passed 1st reading.

According to Jennings, Bill C-416, the Modernization of Investigative Techniques Act, would reduce the ability of criminals, members of organized crime and child pornographers to use new technologies to carry out illegal activities. What MP wouldn't want to get behind this bill, especially with an election looming? How could anyone be opposed to something that is purported to stop organized crime and child pornography?

Given that the two main parties are in agreement on this one, we'll have to hope the NDP will speak up on the enormous privacy issues and vast new police powers this bill will introduce, including:
-interception of all forms of electronic communications, including search and seizure powers
-mandatory data retention for all ISPs, including subscriber information, audit trails and message content
-a reduced standard of "suspicion" to enable interception (as opposed to the higher standard of "reason to believe" in place now)

Law enforcement agencies argue that these are not sweeping powers, but a modernization of powers. Given that the current surveillance legislation was written for telephone surveillance, it is true that law enforcement needs to improved its ability to gather evidence in the case of major crimes. However, the balance of power needs to be addressed to ensure that the principle of privacy is preserved.

We need to ensure that this legislation includes safeguards that will limit the amount and type of data to be maintained, and for how long. We need to preserve the higher standard of "reason to believe" before such powers can be invoked. And we need to ensure a high standard of accountability and oversight for law enforcement agencies.