PRIVACY ORIENTED | From the age of BIG BROTHER – greetings!

A one-man blog addressing privacy issues, covering privacy news, government attacks on privacy, corporate attacks on privacy, RFID, anonymous living, online privacy, financial privacy, surveillance, (pseudo) anonymous money transfer, offshore banking, cryptography and the like. Read by privacy oriented folks in more than 125 countries!


Check Yourself

I support these folks:

Search Posts


Topics

Panama to draw up Tax Treaties instead of TIEAs, ease banking secrecy

February 8th, 2010 by privacyoriented

Latin Letter by Derek Sambrook of Trust Services, S.A. for Offshore Investment Magazine
February 2010

The Spirit of Palmerston

More than a century ago, during Great Britain’s hey day, it was said that Britannia both ruled the waves and waived the rules. As the 19th century British prime minister, Lord Palmerston, stated: “we have no eternal allies and we have no perpetual enemies. Our interests are eternal and perpetual, and those interests it is our duty to follow”. Lord Palmerston’s dictum is itself eternal and perpetual – and has international application; only the superpowers, not those sentiments, change.

Latin America’s leading banking centre, Panama, understands Lord Palmerston’s view, not because it is a world power, but because, great or small, all countries (as with individuals) will usually not place others before their own interests. It is in this spirit that the Panamanian government is approaching the transparency demands of the Organisation for Economic Co-operation and Development (OECD) in relation to the thorny issue of taxation and in doing so, the government has emphasised its intention to be a responsible member of the international community; nonetheless, as Dulcidio de la Guardia, Panama’s Vice-Minister of Finance has put it, the country will “always take care of its interests”.

In a complete reversal of fortune since dictator Manuel Noriega’s forced removal over 20 years ago, Panama’s banks are today well regulated and its Financial Analysis Unit is a member of the Egmont Group (made up of a global collection of national agencies) which enjoys a good reputation. Its common goal is to facilitate information exchange, training and sharing of expertise in the battle against financial crimes. Panama’s enthusiasm is best illustrated by the fact that it ranks fourth among 30 countries surveyed by the Financial Action Task Force (a body set up over 20 years ago by the Group of Seven, a collection of developed countries) because of the efforts it has made to enforce anti-money laundering measures. And unlike the Cayman Islands, which eschews imposing personal income taxes (despite its present financial problems), Panama has always taxed income earned within its borders (27% for individuals and 30% for corporations).

Panama’s government does not favour the ubiquitous tax information exchange agreements of the sort that have been signed in great haste by a number of offshore financial centres; they bring no benefit whatsoever for Panama because with its territorial tax system, it has no interest in foreign income earned. Instead, the government wants to sign double taxation treaties which will not only conform with the spirit of the OECD’s tax information sharing policy, but will actually attract foreign investment to Panama; presently, no tax relief can be claimed against Panamanian taxes imposed on a foreigner’s local profits. This removes the one-way street benefit for foreign governments perhaps appropriate where the information requests involve jurisdictions only offering beaches and attractive legislation but this does not apply in Panama’s case.

It is a common mistake to draw direct comparisons between Panama and such jurisdictions whereas the country’s canal, with its vital international commercial role, is but one example of this error; geopolitics would be another but would require a separate article. Ships can always go round an island, but to profit most from international trade many ships have no choice but to pass through the canal. The canal, in fact, was the cause of a terrible blunder on the part of Ferdinand de Lesseps (the French diplomat who built the Suez Canal) who compared Egypt with Panama. Work commenced before it became clear that constructing a sea-level canal through the flat Egyptian sand (a canal, I would add, which I have passed through) was an entirely different enterprise. The French canal may not have been created but perhaps the longest palindrome phrase in the English language was: A man, a plan, a canal – Panama.
Mistakes aside, whilst much of the OECD transparency tactics can be criticised, I am readily aware that many of the critics haven’t got an unbiased bone in their bodies. They are usually professionals who make their living (as your columnist does) from the steady stream of people and businesses lured by the attractions on offer in offshore financial service centres. Jason Sharman, however, does not fit this description because he is a political scientist at Griffith University in Australia.

His findings summon the spectre of hypocrisy raised in my column one year ago this month (Man, Angels & Brazil – Issue 193) only this time the culprit is the United States of America state of Nevada, not Delaware. The professor found that Nevada’s corporate system offered both light reporting and disclosure requirements – not to mention a quick one-hour incorporation service. In a state with a population of less than three million, Nevada apparently forms about 80,000 new businesses a year with the total now standing at over 400,000. It is understood that when the US Internal Revenue Service undertook a study it discovered that between 50% and 90% of those registering Nevada companies were in breach of federal tax laws elsewhere. Panama, on the other hand, has just over three million citizens and registers perhaps just a little over half the number of companies each year that Nevada does and, like Panama, Nevada does not reveal the names of shareholders.

Armed with USD10,000 in funding and Google as a research partner, Jason Sharman undertook a study of international money laundering; his findings will sit uncomfortably with the OECD. What he found onshore was often a lack of concern in even knowing who the clients were: copy passports and references? Forget them. And, of course, for the people behind the structures, there is no fear of a UBS backlash – personified by the revelations of its former employee, Bradley Birkenfeld – because these middlemen, unlike Swiss bankers and other responsible offshore professionals around the world, were not concerned with knowing who was behind the companies. The professor’s research led him to conclude that the US, and some other OECD members, were far more lax in their due diligence than, say, Switzerland or Liechtenstein.

45 attempts were made by Jason Sharman to create anonymous offshore companies, including bank accounts for them, around the world. These efforts were successful in 17 cases and in 13 of them the country involved was an OECD member. In the United Kingdom, after under an hour on the internet and for less than USD800 without providing identification, he formed an anonymous company and was provided with bearer shares, nominee directors and a secretary. He found, however, that service providers in centres such as Bermuda, the Bahamas, the British Virgin Islands, Liechtenstein and Panama were careful with their due diligence.

An ex-UK Foreign Office adviser (and a former colleague of mine), Rodney Gallagher, suggested in the Financial Times (18 November 2009) that at the end of the day only those offshore jurisdictions with political clout or the support of large countries (such as China) are likely to survive; he includes Hong Kong, the Gulf States, Singapore and Panama on that list.

In the case of Panama this fits in with the views expressed also last November by Susan Haird, Deputy Chief Executive of UK Trade and Investment, a government agency, when she visited the country and with whom I met as Chairman of the Panama-British Business Association (PBBA). She sees Panama as a source of future business for UK companies and believes that “Panama’s strategic position in the world makes it an important trading partner for the UK”. She was the keynote speaker at Britannica Day, a British trade-related event, which is held in Panama every year and organised by the local British Embassy in conjunction with the PBBA.

Panama’s Deputy Minister of Economy and Finance, Mr Frank De Lima, also attended Britannica Day and from discussions I had with him, it would seem that the Panamanian government understands that any tax treaties must be framed sensibly and include the necessary safeguards to deflect attempts to obtain information outside rules which call for evidence and exclude fishing expeditions. It must be why, as head of the delegation who attended tax treaty meetings with Mexico, the Deputy Minister confirmed that the negotiations came to a happy ending and that a treaty should ensue.

Britannia may no longer rule the waves, but she still has her day once a year in Panama. UK exports to the country in 2008 almost reached USD250,000 million and I predict that these are destined to grow steadily every year. After all, in President Martinelli, Panama appears to have the man and the plan.

Posted in Banking Secrecy, Financial Privacy, Offshore Banking, Privacy News | 1 Comment »

USA – Colorado cops get first ID eye-scanners

February 8th, 2010 by privacyoriented

Arapahoe wins federal grant for biometric ID system

by Dave Young KDVR Denver

4:40 PM MST, February 5, 2010

Colorado cops get first ID eye-scanners

Arapahoe County will become the first law enforcement agency in Colorado to begin identifying criminals, missing children and seniors using biometric analysis of the human iris.

A technician from the software and hardware developer demonstrated how their device analyzes the iris, which has 235 identifying points of reference, versus a fingerprint’s 65.

“Fingerprints change but irises stay stable throughout your life,” said Patricia Lawton of Biometric Intelligence and Identifying Technologies, “Which is why it’s a great biometric to identify somebody with.”

Lawton helped develop this new technology application.

She said the iris is 12 times more reliable for identification than a fingerprint.

A National Sheriff’s Association technology grant allows Arapahoe County to be first in the state to apply it to law enforcement.

A deputy helped us demonstrate how it works while Lawton scanned his eyes.

“He won’t tell us who he is,” she said as the deputy held a digital scanner in front of his face and images of his two eyes revealed on a laptop computer screen.

“The camera’s taking a digital photograph of his eyes, the saturation the focus the quality the camera’s talking to him telling him whether or not he’s in range,” Lawton said as on-screen graphics illustrated each item she described.

“In six seconds the information has come back that this is who he is,” she said as a photo image of the deputy appeared on the screen.

The developers say in government studies so far, with more than two million cross matches, there’s never been a false positive with their device.

After initial testing, Arapahoe County will share the technology with other law enforcement agencies across the state who will eventually share criminal and inmate ID records.

“Particularly after we’ve done it for a period of time after a year,” said Arapahoe Sheriff Grayson Robinson, “We will have upwards of 20-thousand inputs into this database.”

Robinson said it will also be used to help track missing kids and seniors who’ve been registered by family members.

“We see this as the future,” said developer Lawton, “This will be the first step when you come in, we’ll match your iris to your records and your records will come up. ”

A record that’s impossible to fake.

Posted in Biometrics, Data Mining, Fingerprints, Iris Scanning, Privacy News, Search & Seizure USA, US Privacy | No Comments »

FBI wants records kept of Web sites visited (by US residents)

February 8th, 2010 by privacyoriented

CNET News / February 5, 2010 9:16 AM PST

WASHINGTON–The FBI is pressing Internet service providers to record which Web sites customers visit and retain those logs for two years, a requirement that law enforcement believes could help it in investigations of child pornography and other serious crimes.

FBI Director Robert Mueller supports storing Internet users’ “origin and destination information,” a bureau attorney said at a federal task force meeting on Thursday.

As far back as a 2006 speech, Mueller had called for data retention on the part of Internet providers, and emphasized the point two years later when explicitly asking Congress to enact a law making it mandatory. But it had not been clear before that the FBI was asking companies to begin to keep logs of what Web sites are visited, which few if any currently do.

The FBI is not alone in renewing its push for data retention. As CNET reported earlier this week, a survey of state computer crime investigators found them to be nearly unanimous in supporting the idea. Matt Dunn, an Immigration and Customs Enforcement agent in the Department of Homeland Security, also expressed support for the idea during the task force meeting.

Greg Motta, the chief of the FBI’s digital evidence section, said that the bureau was trying to preserve its existing ability to conduct criminal investigations. Federal regulations in place since at least 1986 require phone companies that offer toll service to “retain for a period of 18 months” records including “the name, address, and telephone number of the caller, telephone number called, date, time and length of the call.”

At Thursday’s meeting (PDF) of the Online Safety and Technology Working Group, which was created by Congress and organized by the U.S. Department of Commerce, Motta stressed that the bureau was not asking that content data, such as the text of e-mail messages, be retained.

“The question at least for the bureau has been about non-content transactional data to be preserved: transmission records, non-content records…addressing, routing, signaling of the communication,” Motta said. Director Mueller recognizes, he added “there’s going to be a balance of what industry can bear…He recommends origin and destination information for non-content data.”

Motta pointed to a 2006 resolution from the International Association of Chiefs of Police, which called for the “retention of customer subscriber information, and source and destination information for a minimum specified reasonable period of time so that it will be available to the law enforcement community.”

Recording what Web sites are visited, though, is likely to draw both practical and privacy objections.

“We’re not set up to keep URL information anywhere in the network,” said Drew Arena, Verizon’s vice president and associate general counsel for law enforcement compliance.

And, Arena added, “if you were do to deep packet inspection to see all the URLs, you would arguably violate the Wiretap Act.”

Another industry representative with knowledge of how Internet service providers work was unaware of any company keeping logs of what Web sites its customers visit.

If logs of Web sites visited began to be kept, they would be available only to local, state, and federal police with legal authorization such as a subpoena or search warrant.

What remains unclear are the details of what the FBI is proposing. The possibilities include requiring an Internet provider to log the Internet protocol (IP) address of a Web site visited, or the domain name such as cnet.com, a host name such as news.cnet.com, or the actual URL such as http://reviews.cnet.com/Music/2001-6450_7-0.html.

While the first three categories could be logged without doing deep packet inspection, the fourth category would require it. That could run up against opposition in Congress, which lambasted the concept in a series of hearings in 2008, causing the demise of a company, NebuAd, which pioneered it inside the United States.

The technical challenges also may be formidable. John Seiver, an attorney at Davis Wright Tremaine who represents cable providers, said one of his clients had experience with a law enforcement request that required the logging of outbound URLs.

“Eighteen million hits an hour would have to have been logged,” a staggering amount of data to sort through, Seiver said. The purpose of the FBI’s request was to identify visitors to two URLs, “to try to find out…who’s going to them.”

A Justice Department representative said the department does not have an official position on data retention.

Disclosure: The author of this story participated in the meeting of the Online Safety and Technology Working Group, though after the law enforcement representatives spoke.

Posted in Internet Privacy, Online Privacy, Privacy News, Surveillance | No Comments »

Airport Body Scanning Raises Radiation Exposure, Committee Says

February 8th, 2010 by privacyoriented

By Jonathan Tirone / Bloomberg

Feb. 5 (Bloomberg) — Air passengers should be made aware of the health risks of airport body screenings and governments must explain any decision to expose the public to higher levels of cancer-causing radiation, an inter-agency report said.

Pregnant women and children should not be subject to scanning, even though the radiation dose from body scanners is “extremely small,” said the Inter-Agency Committee on Radiation Safety report, which is restricted to the agencies concerned and not meant for public circulation. The group includes the European Commission, International Atomic Energy Agency, Nuclear Energy Agency and the World Health Organization.

A more accurate assessment about the health risks of the screening won’t be possible until governments decide whether all passengers will be systematically scanned or randomly selected, the report said. Governments must justify the additional risk posed to passengers, and should consider “other techniques to achieve the same end without the use of ionizing radiation.”

President Barack Obama has pledged $734 million to deploy airport scanners that use x-rays and other technology to detect explosives, guns and other contraband. The U.S. and European countries including the U.K. have been deploying more scanners at airports after the attempted bombing on Christmas Day of a Detroit-bound Northwest airline flight.

“There is little doubt that the doses from the backscatter x-ray systems being proposed for airport security purposes are very low,” Health Protection Agency doctor Michael Clark said by phone from Didcot, England. “The issue raised by the report is that even though doses from the systems are very low, they feel there is still a need for countries to justify exposures.”

3-D Imaging

A backscatter x-ray is a machine that can render a three- dimensional image of people by scanning them for as long as 8 seconds, the report says. The technology has also raised privacy issues in countries including Germany because it yields images of the naked body.

The Committee cited the IAEA’s 1996 Basic Safety Standards agreement, drafted over three decades, that protects people from radiation. Frequent exposure to low doses of radiation can lead to cancer and birth defects, according to the U.S. Environmental Protection Agency.

Most of the scanners deliver less radiation than a passenger is likely to receive from cosmic rays while airborne, the report said. Scanned passengers may absorb from 0.1 to 5 microsieverts of radiation compared with 5 microsieverts on a flight from Dublin to Paris and 30 microsieverts between Frankfurt and Bangkok, the report said. A sievert is a unit of measure for radiation.

European Union regulators plan to finish a study in April on the effects of scanning technology on travelers’ privacy and health. Amsterdam, Heathrow and Manchester are among European airports that have installed the devices or plan to do so.

The U.S. Transportation Security Administration has said that it ordered 150 scanners from OSI Systems Inc.’s Rapiscan unit and will buy an additional 300 imaging devices this year. The agency currently uses 40 machines, which cost $130,000 to $170,000 each, produced by L-3 Communications Holdings Inc. at 19 airports including San Francisco, Atlanta and Washington D.C.

Last Updated: February 5, 2010 04:31 EST

Posted in Airport & Air Travel Privacy, European Privacy, German Privacy, Privacy News, Security vs. Privacy, Travel Privacy, UK Privacy, US Privacy | No Comments »

The government has your baby’s DNA (in the USA)

February 8th, 2010 by privacyoriented
By Elizabeth Cohen, CNN Senior Medical Correspondent
February 4, 2010 9:11 a.m. EST

Anne Brown worries that someone could gain access to the DNA  sample from her daughter Isabel with Isabel's name attached.

Anne Brown worries that someone could gain access to the DNA sample from her daughter Isabel with Isabel’s name attached.

STORY HIGHLIGHTS

  • Genetic testing for newborns started in the 1960s
  • Specimens are often given to outside researchers
  • Scientists have said the collection of DNA samples is a “gold mine” for doing research

(CNN) — When Annie Brown’s daughter, Isabel, was a month old, her pediatrician asked Brown and her husband to sit down because he had some bad news to tell them: Isabel carried a gene that put her at risk for cystic fibrosis.

While grateful to have the information — Isabel received further testing and she doesn’t have the disease — the Mankato, Minnesota, couple wondered how the doctor knew about Isabel’s genes in the first place. After all, they’d never consented to genetic testing.

It’s simple, the pediatrician answered: Newborn babies in the United States are routinely screened for a panel of genetic diseases. Since the testing is mandated by the government, it’s often done without the parents’ consent, according to Brad Therrell, director of the National Newborn Screening & Genetics Resource Center.

In many states, such as Florida, where Isabel was born, babies’ DNA is stored indefinitely, according to the resource center.

Many parents don’t realize their baby’s DNA is being stored in a government lab, but sometimes when they find out, as the Browns did, they take action. Parents in Texas, and Minnesota have filed lawsuits, and these parents’ concerns are sparking a new debate about whether it’s appropriate for a baby’s genetic blueprint to be in the government’s possession.

“We were appalled when we found out,” says Brown, who’s a registered nurse. “Why do they need to store my baby’s DNA indefinitely? Something on there could affect her ability to get a job later on, or get health insurance.”

According to the state of Minnesota’s Web site, samples are kept so that tests can be repeated, if necessary, and in case the DNA is ever need to help parents identify a missing or deceased child. The samples are also used for medical research.

Art Caplan, a bioethicist at the University of Pennsylvania, says he understands why states don’t first ask permission to screen babies for genetic diseases. “It’s paternalistic, but the state has an overriding interest in protecting these babies,” he says.

However, he added that storage of DNA for long periods of time is a different matter.

“I don’t see any reason to do that kind of storage,” Caplan says. “If it’s anonymous, then I don’t care. I don’t have an issue with that. But if you keep names attached to those samples, that makes me nervous.”

DNA given to outside researchers

Genetic testing for newborns started in the 1960s with testing for diseases and conditions that, if undetected, could kill a child or cause severe problems, such as mental retardation. Since then, the screening has helped save countless newborns.

Over the years, many other tests were added to the list. Now, states mandate that newborns be tested for anywhere between 28 and 54 different conditions, and the DNA samples are stored in state labs for anywhere from three months to indefinitely, depending on the state. (To find out how long your baby’s DNA is stored, see this state-by-state list.)

Brad Therrell, who runs the federally funded genetic resource consortium, says parents don’t need to worry about the privacy of their babies’ DNA.

“The states have in place very rigid controls on those specimens,” Therrell says. “If my children’s DNA were in one of these state labs, I wouldn’t be worried a bit.”

The specimens don’t always stay in the state labs. They’re often given to outside researchers — sometimes with the baby’s name attached.

According to a study done by the state of Minnesota, more than 20 scientific papers have been published in the United States since 2000 using newborn blood samples.

The researchers do not have to have parental consent to obtain samples as long as the baby’s name is not attached, according to Amy Gaviglio, one of the authors of the Minnesota report. However, she says it’s her understanding that if a researcher wants a sample with a baby’s name attached, consent first must be obtained from the parents.

More Empowered Patient news and advice

Scientists have heralded this enormous collection of DNA samples as a “gold mine” for doing research, according to Gaviglio.

“This sample population would be virtually impossible to get otherwise,” says Gaviglio, a genetic counselor for the Minnesota Department of Health. “Researchers go through a very stringent process to obtain the samples. States certainly don’t provide samples to just anyone.”

Brown says that even with these assurances, she still worries whether someone could gain access to her baby’s DNA sample with Isabel’s name attached.

“I know the government says my baby’s data will be kept private, but I’m not so sure. I feel like my trust has been taken,” she says.

Parents don’t give consent to screening

Brown says she first lost trust when she learned that Isabel had received genetic testing in the first place without consent from her or her husband.

“I don’t have a problem with the testing, but I wish they’d asked us first,” she says.

Since health insurance paid for Isabel’s genetic screening, her positive test for a cystic fibrosis gene is now on the record with her insurance company, and the Browns are concerned this could hurt her in the future.

“It’s really a black mark against her, and there’s nothing we can do to get it off there,” Brown says. “And let’s say in the future they can test for a gene for schizophrenia or manic-depression and your baby tests positive — that would be on there, too.”

Brown says if the hospital had first asked her permission to test Isabel, now 10 months old, she might have chosen to pay for it out of pocket so the results wouldn’t be known to the insurance company.

Caplan says taking DNA samples without asking permission and then storing them “veers from the norm.”

“In the military, for instance, they take and store DNA samples, but they tell you they’re doing it, and you can choose not to join if you don’t like it,” he says.

What can parents do

In some states, including Minnesota and Texas, the states are required to destroy a baby’s DNA sample if a parent requests it. Parents who want their baby’s DNA destroyed are asked to fill out this form in Minnesota and this form in Texas.

Parents in other states have less recourse, says Therrell, who runs the genetic testing group. “You’d probably have to write a letter to the state saying, ‘Please destroy my sample,’” he says.

He adds, however, that it’s not clear whether a state would necessarily obey your wishes. “I suspect it would be very difficult to get those states to destroy your baby’s sample,” he says.

CNN’s John Bonifield and Jennifer Bixler contributed to this report

Posted in Biometrics, DNA, Data Mining, Privacy News, US Health Privacy, US Privacy | No Comments »

Google to enlist NSA to help it ward off cyberattacks

February 8th, 2010 by privacyoriented

By Ellen Nakashima

Thursday, February 4, 2010

The world’s largest Internet search company and the world’s most powerful electronic surveillance organization are teaming up in the name of cybersecurity.

// <![CDATA[
var rn = ( Math.round( Math.random()*10000000000 ) );
document.write('') ;
// ]]>

Under an agreement that is still being finalized, the National Security Agency would help Google analyze a major corporate espionage attack that the firm said originated in China and targeted its computer networks, according to cybersecurity experts familiar with the matter. The objective is to better defend Google — and its users — from future attack.

Google and the NSA declined to comment on the partnership. But sources with knowledge of the arrangement, speaking on the condition of anonymity, said the alliance is being designed to allow the two organizations to share critical information without violating Google’s policies or laws that protect the privacy of Americans’ online communications. The sources said the deal does not mean the NSA will be viewing users’ searches or e-mail accounts or that Google will be sharing proprietary data.

The partnership strikes at the core of one of the most sensitive issues for the government and private industry in the evolving world of cybersecurity: how to balance privacy and national security interests. On Tuesday, Director of National Intelligence Dennis C. Blair called the Google attacks, which the company acknowledged in January, a “wake-up call.” Cyberspace cannot be protected, he said, without a “collaborative effort that incorporates both the U.S. private sector and our international partners.”

But achieving collaboration is not easy, in part because private companies do not trust the government to keep their secrets and in part because of concerns that collaboration can lead to continuous government monitoring of private communications. Privacy advocates, concerned about a repeat of the NSA’s warrantless interception of Americans’ phone calls and e-mails after the Sept. 11, 2001, terrorist attacks, say information-sharing must be limited and closely overseen.

“The critical question is: At what level will the American public be comfortable with Google sharing information with NSA?” said Ellen McCarthy, president of the Intelligence and National Security Alliance, an organization of current and former intelligence and national security officials that seeks ways to foster greater sharing of information between government and industry.

On Jan. 12, Google took the rare step of announcing publicly that its systems had been hacked in a series of intrusions beginning in December.

The intrusions, industry experts said, targeted Google source code — the programming language underlying Google applications — and extended to more than 30 other large tech, defense, energy, financial and media companies. The Gmail accounts of human rights activists in Europe, China and the United States were also compromised.

So significant was the attack that Google threatened to shutter its business operation in China if the government did not agree to let the firm operate an uncensored search engine there. That issue is still unresolved.

Google approached the NSA shortly after the attacks, sources said, but the deal is taking weeks to hammer out, reflecting the sensitivity of the partnership. Any agreement would mark the first time that Google has entered a formal information-sharing relationship with the NSA, sources said. In 2008, the firm stated that it had not cooperated with the NSA in its Terrorist Surveillance Program.

Sources familiar with the new initiative said the focus is not figuring out who was behind the recent cyberattacks — doing so is a nearly impossible task after the fact — but building a better defense of Google’s networks, or what its technicians call “information assurance.”

One senior defense official, while not confirming or denying any agreement the NSA might have with any firm, said: “If a company came to the table and asked for help, I would ask them . . . ‘What do you know about what transpired in your system? What deficiencies do you think they took advantage of? Tell me a little bit about what it was they did.’ ” Sources said the NSA is reaching out to other government agencies that play key roles in the U.S. effort to defend cyberspace and might be able to help in the Google investigation.

These agencies include the FBI and the Department of Homeland Security.

Over the past decade, other Silicon Valley companies have quietly turned to the NSA for guidance in protecting their networks.

“As a general matter,” NSA spokeswoman Judi Emmel said, “as part of its information-assurance mission, NSA works with a broad range of commercial partners and research associates to ensure the availability of secure tailored solutions for Department of Defense and national security systems customers.”

Despite such precedent, Matthew Aid, an expert on the NSA, said Google’s global reach makes it unique.

“When you rise to the level of Google . . . you’re looking at a company that has taken great pride in its independence,” said Aid, author of “The Secret Sentry,” a history of the NSA. “I’m a little uncomfortable with Google cooperating this closely with the nation’s largest intelligence agency, even if it’s strictly for defensive purposes.”

The pact would be aimed at allowing the NSA help Google understand whether it is putting in place the right defenses by evaluating vulnerabilities in hardware and software and to calibrate how sophisticated the adversary is. The agency’s expertise is based in part on its analysis of cyber-”signatures” that have been documented in previous attacks and can be used to block future intrusions.

The NSA would also be able to help the firm understand what methods are being used to penetrate its system, the sources said. Google, for its part, may share information on the types of malicious code seen in the attacks — without disclosing proprietary data about what was taken, which would concern shareholders, sources said.

Greg Nojeim, senior counsel for the Center for Democracy & Technology, a privacy advocacy group, said companies have statutory authority to share information with the government to protect their rights and property.

Posted in Internet Privacy, Online Privacy, Privacy News | No Comments »

US Police want backdoor to Web users’ private data

February 8th, 2010 by privacyoriented

CNET News

Anyone with an e-mail account likely knows that police can peek inside it if they have a paper search warrant.

But cybercrime investigators are frustrated by the speed of traditional methods of faxing, mailing, or e-mailing companies these documents. They’re pushing for the creation of a national Web interface linking police computers with those of Internet and e-mail providers so requests can be sent and received electronically.

CNET has reviewed a survey scheduled to be released at a federal task force meeting on Thursday, which says that law enforcement agencies are virtually unanimous in calling for such an interface to be created. Eighty-nine percent of police surveyed, it says, want to be able to “exchange legal process requests and responses to legal process” through an encrypted, police-only “nationwide computer network.” (See one excerpt and another.)

The survey, according to two people with knowledge of the situation, is part of a broader push from law enforcement agencies to alter the ground rules of online investigations. Other components include renewed calls for laws requiring Internet companies to store data about their users for up to five years and increased pressure on companies to respond to police inquiries in hours instead of days.

But the most controversial element is probably the private Web interface, which raises novel security and privacy concerns, especially in the wake of a recent inspector general’s report (PDF) from the Justice Department. The 289-page report detailed how the FBI obtained Americans’ telephone records by citing nonexistent emergencies and simply asking for the data or writing phone numbers on a sticky note rather than following procedures required by law.

Some companies already have police-only Web interfaces. Sprint Nextel operates what it calls the L-Site, also known as the “legal compliance secure Web portal.” The company even has offered a course that “will teach you how to create and track legal demands through L-site. Learn to navigate and securely download requested records.” Cox Communications makes its price list for complying with police requests public; a 30-day wiretap is $3,500.

The police survey is not exactly unbiased: its author is Frank Kardasz, who is scheduled to present it at a meeting (PDF) of the Online Safety and Technology Working Group, organized by the U.S. Department of Commerce. Kardasz, a sergeant in the Phoenix police department and a project director of Arizona’s Internet Crimes Against Children task force, said in an e-mail exchange on Tuesday that he is still revising the document and was unable to discuss it.

In an incendiary October 2009 essay, however, Kardasz wrote that Internet service providers that do not keep records long enough “are the unwitting facilitators of Internet crimes against children” and called for new laws to “mandate data preservation and reporting.” He predicts that those companies will begin to face civil lawsuits because of their “lethargic investigative process.”

“It sounds very dangerous,” says Lee Tien, an attorney with the Electronic Frontier Foundation, referring to the police-only Web interface. “Let’s assume you set this sort of thing up. What does that mean in terms of what the law enforcement officer be able to do? Would they be able to fish through transactional information for anyone? I don’t understand how you create a system like this without it.”

What police see in ISPs
Kardasz’s survey, based on questionnaires completed by 100 police investigators, says that 61 percent of them had their investigations harmed “because data was not retained” and only 40 percent were satisfied with the timeliness of responses from Internet providers.

“You can be very supportive of law enforcement investigations and at the same time be very cognizant and supportive of the privacy rights of our users.”

–Hemanshu Nigam, chief security officer, MySpace

It also says: “89 percent of investigators agreed that a nationwide computer network should be established for the purpose of linking ISPs with law enforcement agencies so that they may exchange legal process requests and responses to legal process. Authorized users would communicate through encrypted virtual private networks in order to maintain the security of the data.”

Some of the responses to other questions: “AT&T is very prompt.” “Cox Communications seems to be the worst.” “Places like Yahoo can take a month for basic subscriber info which is also a problem.” “AT&T Mobility does not keep a log at all.” “MySpace give (sic) me the quickest response and they have been very pro-police.”

Hemanshu (Hemu) Nigam, MySpace’s chief security officer, said in an interview with CNET on Tuesday that: “You can be very supportive of law enforcement investigations and at the same time be very cognizant and supportive of the privacy rights of our users. Every time a legal process comes in, whether it’s a subpoena or a search order, we do a legal review to make sure it’s appropriate.”

Nigam said that MySpace accepts law enforcement requests through e-mail, fax, and postal mail, and that it has a 24-hour operations center that tries to respond to requests soon after they’ve been reviewed to make sure state and federal laws are being followed. MySpace does not have a police-only Web interface, he said.

Creating a national police-only network would be problematic, Nigam said. “I wish I knew the number of local police agencies in the country, or even police officers in the country,” he said. “Right there that would tell you how difficult it would be to implement, even though ideally it would be a good thing.”

Another obstacle to creating a nation-wide Web interface for cops–one wag has dubbed it “DragNet,” and another “Porknet”–is that some of its thousands of users could be infected by viruses and other malware. Once an infected computer is hooked up to the national network, it could leak confidential information about ongoing investigations.

Jim Harper, a policy analyst at the free-market Cato Institute, says that he welcomes the idea of a police-only Web interface as long as it’s designed carefully. “A system like this should have strong logins, should require that the request be documented fully, and should produce statistical information so there can be strong oversight,” he says. “I think that’s a good thing to have.”

Posted in Internet Privacy, Online Privacy, Privacy News, US Privacy | 1 Comment »

Driver’s Licenses for the Internet?

February 3rd, 2010 by privacyoriented

February 3, 2010, 6:33 am / NewYorkTimes – Idea of the Day Blog

Today’s idea: Let’s have “driver’s licenses” for the Internet to counter online fraud, hackers and espionage, a Microsoft executive suggests.

Maybe on your busy junket to the World Economic Forum in Davos last week you missed the panel where Craig Mundie, Microsoft’s chief research and technology officer, offered up the Internet licensing proposal above. Barbara Kiviat of the Curious Capitalist blog was there, and summarizes the idea thusly:

DESCRIPTION
Isaac Brekken for The New York Times
Licenses for both wheel and Web? (Audi’s planned dashboard screen, right.)

What Mundie is proposing is to impose authentication. He draws an analogy to automobile use. If you want to drive a car, you have to have a license (not to mention an inspection, insurance, etc.). If you do something bad with that car, like break a law, there is the chance that you will lose your license and be prevented from driving in the future. In other words, there is a legal and social process for imposing discipline. Mundie imagines three tiers of Internet I.D.: one for people, one for machines and one for programs (which often act as proxies for the other two).

Now, there are, of course, a number of obstacles to making such a scheme be reality. Even here in the mountains of Switzerland I can hear the worldwide scream go up: “But we’re entitled to anonymity on the Internet!” Really? Are you? Why do you think that?

Mundie [above] pointed out that in the physical world we are implicitly comfortable with the notion that there are certain places we’re not allowed to go without identifying ourselves. Are you allowed to walk down the street with no one knowing who you are? Absolutely. Are you allowed to walk into a bank vault and still not give your name? Hardly.

The Internet was never originally intended as a worldwide system of mass communication, Ms. Kiviat notes, let alone a largely anonymous one. But that is what it grew into, replete with feisty commenters like those reacting to her post. [The Curious Capitalist]

Posted in Anonymity, Internet Privacy, Online Privacy, Privacy News | No Comments »

Driver’s licenses for the Internet

February 3rd, 2010 by privacyoriented
Posted by Barbara Kiviat Saturday, January 30, 2010 at 5:16 am / Time.com Blog

I just went to a panel discussion about Internet security and let me tell you, it was scar-y. Between individual fraud, organized crime, corporate espionage and government spying, it’s an incredibly dangerous world out there, which, according to one panelist, is growing exponentially worse.

These are incredibly complex problems that even the smartest of the smart admit they don’t have a great handle on, although Craig Mundie, Microsoft’s chief research and technology officer, offered up a surprisingly simple solution that might start us down a path to dealing with them: driver’s licenses for the Internet.

The thing about the Internet is that it was never intended to be a worldwide system of mass communication. A handful of guys, all of whom knew each other, set up the Web. The anonymity that has come to be a core and cherished characteristic of the Internet didn’t exist in the beginning: it was obvious who was who.

As the Internet picked up steam and gathered more users, that stopped being the case, but at no point did anyone change the ways things worked. The Web started out being a no-authentication space and it continues to be that way to this day. Anyone can get online and no one has to say who they are. That’s what enables a massive amount of cyber crime: if you’re attacked from a computer, you might be able to figure out where that particular machine is located, but there’s really no way to go back one step further and track the identity of the computer that hacked into the one that hacked into you.

What Mundie is proposing is to impose authentication. He draws an analogy to automobile use. If you want to drive a car, you have to have a license (not to mention an inspection, insurance, etc). If you do something bad with that car, like break a law, there is the chance that you will lose your license and be prevented from driving in the future. In other words, there is a legal and social process for imposing discipline. Mundie imagines three tiers of Internet ID: one for people, one for machines and one for programs (which often act as proxies for the other two).

Now, there are, of course, a number of obstacles to making such a scheme be reality. Even here in the mountains of Switzerland I can hear the worldwide scream go up: “But we’re entitled to anonymity on the Internet!” Really? Are you? Why do you think that?

Mundie pointed out that in the physical world we are implicitly comfortable with the notion that there are certain places we’re not allowed to go without identifying ourselves. Are you allowed to walk down the street with no one knowing who you are? Absolutely. Are you allowed to walk into a bank vault and still not give your name? Hardly.

It’s easy to envision the same sort of differentiated structure for the Internet, Mundie said. He didn’t get into examples, so here’s one of mine. If you want to go to Time.com and read all about what’s going on in the world, that’s fine. No one needs to know who you are. But if you want to set up a site to accept credit-card donations for earthquake victims in Haiti? Well, you’re going to have to show your ID for that.

The truth of the matter is, the Internet is still in its Wild West phase. To a large extent, the law hasn’t yet shown up. Yet as more and more people move to town, that lawlessness is becoming a bigger and bigger problem. As human societies grow over time they develop more rigid standards for themselves in order to handle their increased size. There is no reason to think the Internet shouldn’t follow the same pattern.

Though that’s not to say it’ll happen anytime soon. Governments certainly have been talking to each other about this (almost by definition, any effective efforts will have to be international in nature), but even in Europe, where there is a cyber security convention in effect, only half of the Continent’s nations have signed up.

One stumbling block that was mentioned at today’s panel discussion: governments’ own intelligence agencies are huge beneficiaries of the Internet’s anonymity. We managed to spy on each other before the Web, but how much easier it is now that we can cruise around cyberspace without anyone even knowing we’re there.

So don’t expect any changes in the short term. But do know that the people in charge—as much as anyone can be in charge when it comes to the Internet—are thinking about it.

Posted in Anonymity, Internet Privacy, Online Privacy, Privacy News | No Comments »

Year of the Rat — I Mean, Census

February 3rd, 2010 by privacyoriented

By Becky Akers / Campaign for Liberty
View all 5 articles by Becky Akers
Published 02/02/10

“Representatives and direct Taxes shall be apportioned among the several States which may be included within this Union, according to their respective Numbers. . . ,” says Article I, Section 2 of the United States’ Constitution. “The actual Enumeration shall be made. . . within every subsequent Term of ten Years, in such Manner as they shall by Law direct.”

Serfs who suffer the Census Bureau’s invasive curiosity might consider this one of the Constitution’s errors, right up there with granting Congress power over the eighteenth-century version of telecoms (”To establish Post Offices and Post Roads”) and our wallets (”To coin Money, regulate the Value thereof” and “provide for the Punishment of counterfeiting.” [Art. 1, Sec. 8]). The Census is indeed a mistake, not only in its concept but in the phrasing: given the latitude of “in such Manner as they shall by Law direct,” it’s hard to argue that any question bureaucrats ask, whether via mail, phone, or personal visits, violates the Constitution once legislation authorizes it. Indeed, that document’s elasticity enables the Census Bureau to justify even its annual “surveys” by claiming they help with its gargantuan, decennial task.

Liberty knew no reason in 1789 for the Feds to specifically and specially count us; there’s even less now. One of the Constitution’s excuses for a census — taxation — is always and totally incompatible with freedom. And since Public Law 62-5 capped the number of Congressional seats at 435 in 1913, why not settle for an estimate of a population’s density when it comes to determining a state’s representation in the House?

Estimates were available in the 18th century just as they are today and from the same source: entrepreneurs who must gauge the size of their market. Would compiling statistics from artisans and shop-owners have required a bureaucrat to bestir himself from his office and talk to the hard-working men paying his salary? Sure. Would many of them have told him to scram? Let’s hope so — but we want an approximation, so what does it matter? The importance of exact figures grows in proportion to Leviathan’s power. Better to defang the monster than to count citizens.

The same holds true today. Frighteningly accurate counts of households and even individuals abound; abolish the Census Bureau, and the market will tell us how many folks live where while filling in the demographic details the “American Community Survey” collects. Indeed, America’s private market-research industry is worth $10 billion annually. Yet you’d never suspect that from listening to the Bureau, which touts its “mission” as “serv[ing] as the leading source of quality data about the nation’s people and economy…” Talk about expanding an agency far beyond its purpose so it can consume an ever-growing budget!

But the government’s depending on entrepreneurs for anything at all, whether for “outsourcing” and privatization, products and supplies, or even information, also smothers freedom. We who understand the market’s blessings and power should oppose its cooperating with the State in any way.

Which begs the question of whether the Feds should know our numbers, let alone the other tidbits they seek. Can freedom flourish while government amasses knowledge about us, even if restricted to an “Enumeration” alone? Was there a time when the census was only that, just a count and not a window into our lives for bureaucratic Peeping Toms?

Actually — no. Even the first census, conducted in 1790 under the auspices of libertarian hero and Secretary of State Thomas Jefferson, offends: US marshals canvassed the country on horseback. Picture a farmer plowing his 50 acres in Pennsylvania of a spring morning when Marshal Thug gallops into his field. Thug demands of this beleaguered citizen the “name of the head of. . . household, how many free white males age 16 and older, how many free white males under age 16, how many free white females, how many of all other free persons,” — and here we silly citizens assume “male” and “female” pretty well covers it — and “how many slaves.” So much for the brand-new Constitution’s limited government.

By 1850, the snooping had gone serious. Now Congress demanded the names of everyone, not just the breadwinner, as well as his “place of birth, age [which the census had specifically ‘asked since 1800'], sex,…occupation, value of real estate, if married within the year, if pauper or convict, if blind, insane, deaf or dumb.” We expect such prying from the modern Leviathan, but from the relatively undernourished beast of 1850? It seems even “small” government won’t keep its nose out of our business.

Today’s Feds continue fervent in their fanaticism for the census, so much so that you’d think they lack computers, the IRS, FISA’s warrantless wiretaps, “pen/trap devices,” black boxes at compliant ISP’s, and the myriad bureaucracies that monitor all we say and do. Why? When the Feds already know the answers to their infernal questions, why bother asking us? What explains their devotion to this charade?

The Census Bureau blames it partly on the Constitution’s “mandate,” of course. Hooey. The Feds have proved for decades that they rank the Constitution somewhere below used toilet paper.

The bureau hypes a second reason which, ironically enough, is precisely why we ought to resist: the census helps rulers “to make decisions about what community services to provide” as they (re-) “distribute more than $400 billion in federal funds to local, state and tribal governments each year.” Entire pages of the website “Census 2010” explain “How It Benefits Your Community.” Indeed, the Feds constantly dangle their idea of goodies before us: “Other important uses of Census data include the distribution of funds for government programs such as Medicaid; planning the right locations for schools, roads, and other public facilities.”

In other words, answering the State’s busybodies condemns us to traffic jams as the loot for building and repairing roads floods our districts. Eminent domain could steal our land for a new school. And we’ll endure longer waits at hospitals thanks to the throngs of Medicaid’s leeches. It’s no mystery why pork is a politician’s favorite dish, but taxpayers’ tolerating this oinky oppression is a mystery for the ages.

Yet the Bureau shamelessly crows about abetting communism. “The money the Census allocates to our communities is more than which country’s gross domestic product?” its website coyly asks. “Papua New Guinea, Switzerland, the United Arab Emirates, All of the above?” Clicking the obvious elicits these boastful congratulations: “You are correct! The GDP for Papua New Guinea is $12.05 billion. The GDP for Switzerland is $303.2 billion. And the GDP for The United Arab Emirates is $164.4 billion. The Census Bureau allocates over $400 billion to our communities every year.”

If that doesn’t spark revolution, perhaps the Bureau’s lies will: they’re just as bold as its bragging. “Your individual responses cannot be used to target you for any government purpose,” the Bureau categorically promises. And there’s this from James T. Christy, Los Angeles’ Regional Office Director for the Census Bureau: “No one can get access to census data. It is rock solid secure.” Really? The Feds’ access to census data from 1940 is so notorious that when I typed “census Ja—,” Google Search filled in the rest “–panese internment.”

Such snitching isn’t just ancient history: “on two occasions after the attacks of Sept. 11, 2001,” the Orwellian Department of Homeland Security (DHS) “requested” “data that identified populations of Arab-Americans.” The “comprehensive reports” the Census Bureau “provided. . . list[ed] Arab-American populations by city and ZIP code.” DHS’s “officials” blandly contend that the information “simply. . . help[ed] them decide at which airports they needed to post Arabic language signs.” But Barry Steinhardt of the ACLU connects it with results far more sinister: ”Thousands of Arab-Americans have been rounded up and deported.”

Given these sorts of risks, as well as our rulers’ angst lest we spurn their senseless census, you might suppose they would refrain from insulting us. But no. Like bureaucrats everywhere, those administering the census consider us idiots. Their “Questions on the Form” — which they hasten to assure us is “One of the shortest forms in history – 10 Questions in 10 Minutes” — begin with “How many people were living or staying in this house, apartment, or mobile home on April 1, 2010?” Question #5 orders you to list those residents by name — not so the Feds can track us, oh, my, no. The Bureau requires this catalog solely because we are incompetent: “Listing the name of each person in the household helps the respondent to include all members, particularly in large households where a respondent may forget who was counted and who was not.” Yeah, it’s easy to forget that your elderly parents moved in with you, your wife, and your two kids. And it’s not as though you ever tell the hostess at the diner that there are six in your party when she seats you.

In case its bribes and lies don’t work, the Census Bureau threatens us as well: “Congress has determined . . . that individuals do not have the option to decline to participate.” In other words, “participation isn’t just important—it’s mandatory.”

And that explains DC’s obsession with the census. All governments, even the most brutal and totalitarian, depend on the consent of the governed. Once enough of those victims determine to resist the State’s extortion (a.k.a., taxation), surveillance (a.k.a., police protection), and murder (a.k.a., war), the government falls.

As the Feds become increasingly dictatorial, they increasingly seek our assent to their crimes. Voting is one form of that approval; “participation” via juries and the census is another. And of course, “working” for them is best of all: “For the 2000 census, the Census Bureau employed more than 500,000 people to visit the homes of people who did not return their mail-in census form.” That’s in addition to the “headquarters staff” of 4,285.

All that make-work doesn’t come cheap. The Census Bureau’s budget for 2009 amounted to something like $238,740, 000 — but apparently that just turned on the lights at headquarters. Any actions the bureaucrats actually take require “appropriations.” The “Periodic Censuses and Programs” rooked us of another $2,365,882,000. A couple of additional expenses brought the total for 2009 to a whopping $2,634,622,000 — and that wasn’t a decennial year.

Just imagine how much more of our money these wastrels will squander in 2010. Not to worry: the sort of economists the New York Times quotes assure us that though the “1.2 million census-taking jobs may be temporary, . . . they pay well.” Yep, snitching often does. How much is the Bureau shelling out so your neighbors will pester you into answering questions no government should ask? “. . . $10 to $25 an hour,” the Times gloats. “‘These are real jobs with good solid hourly pay,’ said Mark Zandi, chief economist for Moody’s Economy.com. Mr. Zandi added: ‘It’s a form of stimulus. It’s like infrastructure spending, or W.P.A. in the Depression. . . .’”

It’s not just “a form of stimulus,” it is the stimulus since a billion of what they’ll waste comes from the American Recovery and Reinvestment Act. Your taxes are already paying for the Bureau to recycle propaganda about this anti-constitutional racket, which it describes as “an unprecedented effort to jumpstart the U.S. economy, create or save millions of jobs, and put a down payment on addressing long-neglected challenges so the country can thrive in the twenty-first century. The Recovery Act . . . includes measures to modernize the nation’s infrastructure, enhance energy independence, expand educational opportunities, preserve and improve affordable health care, provide tax relief and protect those in greatest need.” That would be taxpayers, yet the stimulus dramatically increases their burdens.

Ditto the census and its Bureau. Both are dire enemies to liberty. Were the first Secretary of State alive today, he might paraphrase his quote on newspapers: “If it were left to me to decide whether we should have a census and government or neither and freedom, I should not hesitate a moment to prefer the latter.”
Copyright © 2010 Campaign for Liberty

Posted in Anonymity, Data Mining, Off-the-Grid Living, US Census, US Privacy | No Comments »

« Previous Entries