Smart Grid and Privacy: EFF Comments and Upcoming PUC Hearings

I've written quite extensively on the growing debate over smart electricity meters and the potential threat they pose to privacy (if we don't take the proper precautions).

To read my article on the subject that was published on the California Progress Report just click here.

As I also mentioned in past posts, in response to a rulemaking by the California PUC, and the lack of attention being paid to the concerns of privacy advocates to date on this issue, the Consumer Federation of California (CFC) recently joined The Utilities Reform Network (TURN) in urging the Commission to allow for a more comprehensive review and debate regarding such concerns.

I'm happy to report that not only has such a discussion been planned for March 19th by the CPUC, but yours truly, will be one of the panelists. Here's a few more details:

March 19, 2010
9:30 am – 4:30 pm
Auditorium
CPUC, 505 Van Ness Avenue, San Francisco, CA 94102

The workshop will focus on the rules that the CPUC should adopt to meet the objectives of providing access to:

1. Wholesale and retail price information,
2. Access to usage data for authorized third parties; and,
3. Access on a near real-time basis to usage data by consumers and/or authorized third parties.

Agenda

9:30 a.m. - 9:45 a.m. Welcome and Opening Comments:
Assigned Commissioner Nancy E. Ryan & ALJ Sullivan

9:45 a.m. - 10:30 a.m. Smart Meter Texas - Bob Frazier, Center Point Utility, will discuss the experience of Texas utilities in building a web portal to provide usage, cost, and customer interface

10:30 a.m. – noon Customer Perspective – Ensuring customer privacy

Panelists:
· Karin Hieta, DRA
· Marcel Hawiger, TURN
· Zack Kaldveer, CFC
· Jim Dempsey, CDT

1:00 p.m. - 2:30 p.m. Vendors Perspective – Creating a system capable of providing the data

Panelists:
· Duke Troxell, EDS
· Michael Terrell, Google
· Dave Mollerstuen, Tendril
· Mark Potter, EnerNoc

2:30 p.m. - 2:45 p.m. Break

2:45 p.m. - 4:15 p.m. Utility Perspective – Obstacles & Opportunities

Panelists:
· Paul DeMartini, SCE
· Ed Fong, SDG&E
· Andrew Tang, PG&E
· Bob Frazier, Center Point


For today, I wanted to post some of what the Electronic Frontier Foundation's Lee Tien - someone who's expertise I often use in writing this blog - had to say about Smart Grid and Privacy, the upcoming PUC hearings, as well as his own organizations filings to the PUC with the Center for Democracy and Technology.

Lee writes:

The ebb and flow of gas and electricity into your home contains surprisingly detailed information about your daily life. Energy usage data, measured moment by moment, allows the reconstruction of a household's activities: when people wake up, when they come home, when they go on vacation, and maybe even when they take a hot bath.

California's PG&E is currently in the process of installing "smart meters" that will collect this moment by moment data—750 to 3000 data points per month per household—for every energy customer in the state. These meters are aimed at helping consumers monitor and control their energy usage, but right now, the program lacks critical privacy protections.

That's why EFF and other privacy groups filed comments with the California Public Utilities Commission Tuesday, asking for the adoption of strong rules to protect the privacy and security of customers' energy-usage information. Without strong protections, this information can and will be repurposed by interested parties. It's not hard to imagine a divorce lawyer subpoenaing this information, an insurance company interpreting the data in a way that allows it to penalize customers, or criminals intercepting the information to plan a burglary. Marketing companies will also desperately want to access this data to get new intimate new insights into your family's day-to-day routine–not to mention the government, which wants to mine the data for law enforcement and other purposes.

This isn't just a California issue. Many threats to the privacy of the home—where our privacy rights should be strongest—were detailed in a 2009 report for the Colorado Public Utility Commission. The federal government has been promoting the smart grid as part of its economic stimulus package, and last year, EFF and other groups warned the National Institute of Standards and Technology about the privacy and security issues at stake.

For example, security researchers worry that today’s smart meters and their communications networks are vulnerable to a variety of attacks. There are also questions of reliability, as PG&E faces criticism from California customers who have seen bills skyrocket after the installation of the new "smart meters." Unsurprisingly, California legislators are questioning the rapid rollout. Texas customers are also complaining.

There are far more questions than answers when it comes to this new technology. While it's potentially beneficial, it could also usher in new intrusions into our home and private life. The states and the federal government should ensure that energy customers get the protection they deserve.

Stay tuned...

Travelers File Suits Against Body Scanners As Their Use Expands

I want to do a quick update today on the progress of the friendly little digital strip searches that are coming to an airport near you. I speak of course of what has been coined as "Whole-Body-Imaging". As I wrote in my article "The Politics of Fear and "Whole-Body-Imaging", these full-body scanners use one of two technologies - millimeter wave sensors or backscatter x-rays - to see through clothing, producing images of naked passengers.

As I lay out in detail, there are MANY reasons to oppose the widespread use of these scanners, from the obvious, privacy, to the less so, they won't make us any safer. In fact, if you define the word "safe" as also including the concept of "safe" from government intrusiveness and fear peddling, than I would argue it makes us less so, not more.

A Review: Why Airport Body Scanners Should be Opposed

Before I get to the increasing use of these scanners, the growing number of customer complaints against them, and the efforts being made by privacy advocates to halt their implementation altogether until several health, safety and privacy issues are resolved, I want to just quickly highlight the main arguments against their use.

Before embracing this latest "terror fix", we should consider the larger context at work here: for every specific tactic we target with a new, expensive, and often burdensome security apparatus, the terrorist's tactics themselves will change.

Risks can be reduced for a given target, but not eliminated. If we strip searched every single passenger at every airport in the country, terrorists would try to bomb shopping malls or movie theaters.

Before we all run for the hills screaming "the terrorists are coming", willfully give up our civil liberties and freedoms, support wars on countries that did nothing to us, and sign off on wasting HUGE amounts of money on ineffectual security systems, consider this: Your chances of getting hit by lightning in one year is 500,000 to 1 while the odds you'll be killed by a terrorist on a plane over 10 years is 10 million to 1.

Does this sound like a threat worthy of increasing the already long list of airline passenger indignities? Isn't suffering through longer and longer lines while being shoeless, beltless, waterless, and nail clipper-less enough? Now we've got to be digitally strip searched too?

Then there are the privacy concerns regarding how images could be stored...and just the basic guttural reaction of "screw you I'm not letting you see me naked for no reason!" argument.

The Electronic Privacy Information Center, a public interest research group, published documents in January revealing that the machines can record, store and transmit passenger scans.

Are we really to believe the government won't allow these devices to record any data when the easy "go to" excuse for doing so will be the need to gather and store evidence? What about the ability of some hacker in an airport lounge capturing the data using his wi-fi capable PC - and then filing it to a Flickr album, and then telling of its whereabouts on Twitter?

For these reasons, privacy advocates continue to argue for increased oversight, full disclosure for air travelers, and legal language to protect passengers and keep the TSA from changing policy down the road. Again, what's to stop the TSA from using clearer images or different technology later?

Is the loss of freedom, privacy, and quality of life a worthwhile trade-off for unproven protections from a terrorist threat that has a 1 in 10 million chance of killing someone over a ten year time period?

Could all this hype be just another way to sell more security technologies, soften us up for future wars, increased spending on the military, and the evisceration of our civil liberties?Walking through a whole-body scanner or taking a pat-down shouldn't be the only two options for citizens living in a free society.

As the ACLU pointed out, "A choice between being groped and being stripped, I don't think we should pretend those are the only choices. People shouldn't be humiliated by their government" in the name of security, nor should they trust that the images will always be kept private. Screeners at LAX (Los Angeles International Airport) could make a fortune off naked virtual images of celebrities...The Bill of Rights extends beyond curbside check-in and if the government insists on using these invasive search techniques, it is imperative that there be vigorous oversight and regulation to protect our privacy. Before these body scanners become the status quo at America's airports, we need to ensure new security technologies are genuinely effective, rather than merely creating a false sense of security."

Number of Airports Using Scanners Increases as Customer Complaints Rise

The Homeland Security Department on Friday announced that it will expand the use of advanced imaging technology to 11 U.S. airports, thanks to $1 billion in Recovery Act funds. The TSA already has 40 units in 19 airports nationwide and expects to have an additional 450 deployed by the end of 2010.

The TSA plans to install close to 900 body scanners at airports around the U.S. by 2014. About 200 AIT scanners are expected to be deployed by the end of this year at a cost of $130,000 to $170,000 per device.

So the bad news is the government is moving full steam ahead. But, this is not to say there still isn't a vigorous opposition campaign underway. Documents obtained by the Electronic Privacy Information Center (EPIC) show that complaints have been lodged with the Transportation Security Administration (TSA) over the use of whole-body scanners at U.S. airports, particularly related to lack of instructions and information on alternatives.

Computerworld reports:

More than two-dozen complaints that were filed by travelers subjected to whole-body scans over the past year or so were included in a document obtained by EPIC as the result of a Freedom of Information Act lawsuit.

The 51 pages of documents show that travelers were often not fully informed about the scans or what the process involved. Some complained about a lack of instructions or signage regarding the scanning machines, while others said they were not informed about the pat-down alternative available to those who don't want to be scanned. Travelers also expressed concern about their privacy being invaded, of feeling humiliated, of radiation risks to pregnant women and of children being subjected to the scans.

The letters belie the TSA's claims about the disclosure policies related to the use of the technology and of the general level of concern related to its use, said Ginger McCall, staff counsel at EPIC. "The TSA has been reassuring people that travelers will be made aware of what these machines are and of the alternatives that are available," McCall said. The complaints suggest otherwise and appear to show less support for the technology than the TSA has let on, she said.

...

Privacy advocacy groups have claimed that the use of such scanners is tantamount to doing a strip search of air travelers. Security analysts and even the Government Accountability Office meanwhile have called for a thorough review of the effectiveness of the technology in day-to-day operations. Some have expressed concern that whole-body scanners will be ineffective in detecting explosives hidden in body cavities. Such concerns have already prompted a three-month review of the technology in Europe.

Click here for the rest of the article.

I go back to this quote a lot, but I think its important to remember everytime we have this larger debate over privacy versus security. Bruce Schneier, author of Beyond Fear: Thinking Sensibly About Security in an Uncertain World, sums up the false choice perfectly:"If you set up the false dichotomy, of course people will choose security over privacy -- especially if you scare them first. But it's still a false dichotomy. There is no security without privacy. And liberty requires both security and privacy. The famous quote attributed to Benjamin Franklin reads: "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." It's also true that those who would give up privacy for security are likely to end up with neither.”

I would also point you to Dr. Amster, a professor of peace studies at Prescott College and the executive director of the Peace & Justice Studies Association:

And then there are the obvious matters of privacy and dignity. One need not be a constitutional scholar or privacy-rights advocate to appreciate the implications of conducting such invasive de facto "strip searches" on a widespread scale. ...The New York Times further noted that "others say that the technology is no security panacea, and that its use should be carefully controlled because of the risks to privacy, including the potential for its ghostly naked images to show up on the Internet." Indeed, as Baltimore Sun columnist Susan Reimer intoned:

"They say these full-body screening images - in which I am pretty sure we are naked - are immediately erased, but I don't believe them for a minute. Either somebody is keeping them on the hard drive to protect himself in case some terrorist gets by on his watch, or some enterprising guy is going to be selling Britney Spears' body scan to TMZ for a hundred thousand bucks. I mean this is America, land of the irrepressible entrepreneurial spirit."

Absent clear and enforceable limitations, it seems likely that such scenarios will ensue....Despite being known as a fairly Puritanical people in many respects - at least in terms of what constitutes "public decency" and the like - it seems that Americans perhaps are more permissive in their sense of decorum than we have been led to believe. Is it still voyeurism when the subject willingly desires to be watched? Must security and privacy exist in tension, or can they be fruitfully reconciled? Is constant surveillance becoming the baseline of our lives, and if so, who is watching the watchers? With the proliferation of public cameras, digital recorders, webcams, cellphone cameras and, now, terahertz scanners, we will be confronted with the implications of these technologies for the foreseeable future. The fact that our collective fears seem to be the leading edge of the debate doesn't bode particularly well for reasoned decision-making and the eventual utilization of new technologies for emancipation rather than subjugation.

And in the End …

The matter of full-body scanners presents a critical cultural referendum on basic questions of freedom and autonomy. The circumstances under which the issue is being presented - a climate of fear instilled by a well-hyped reminder of the shared trauma of 9/11 - make it almost impossible to have confidence in a sound and sober resolution. Moreover, the primary players behind the use of these technologies are imbricated within the workings of a growing military-industrial complex that continues to pervade more aspects of our lives. This watershed moment in the public dialogue about security and privacy is framed by an increasing militarization of everyday life in America, as indicated by a recollection of the loci in which companies like Rapiscan operate - namely, "at airports, government and corporate buildings, correctional and prison facilities, postal facilities, military zones, sea ports and border crossings." This list could easily expand to include schools, hospitals, malls, arenas, banks, stores, and more. Now is the moment to rein it in while we still have a window of self-determination in which to do so.

Pro-Civil Liberties "Candidate Obama" vs. Anti-Civil Liberties President Obama

I haven't been shy in sharing my utter disappointment in the Obama Administration when it comes to civil liberties and privacy (and just about everything else too). As I've often stated, the term "better than Bush" has little to no meaning to me, as, what could be worse than Bush when it comes to these issues? Is that really the bar we choose to judge people by these days? If it is, we are in one heap of trouble. When it comes to issues like privacy, we can't start grading on a curb...at least not one bent like that.

Now, before I get to a great article in American Prospect entitled Obama, Congress Wink at Massive Surveillance Abuses, I want to go through some of the list of betrayals, backtracking, and reversals by this Administration on substantive issues that the President RAN ON.

The list is getting, literally, too long for me to address these days. So forgive me for reaching back into my archives and getting some help...from myself.

We all know by now the Administration's whole-hearted embrace of Whole-Body-Imaging in airports.

As we also now know, both Obama and Holder have completely reversed themselves on the issue of wiretapping, by not only refusing to prosecute or investigate the program and/or those that carried it out, but have even expanded their defense of the program in some important key respects. Telecom immunity? You bet. Justice for those spied on? Hell no.

We also now KNOW, that it was President Obama himself that worked behind the scenes to ensure that absolutely no meaningful reforms to the Patriot Act were adopted...essentially a complete reversal of his positions as a Senator and Presidential candidate. Strange, he doesn't lift a finger for things like the public option or the Consumer Protection Agency, but man, he's one tough customer when it comes to protecting the Patriot Act.

Its as if we're watching a debate between the eloquent, pro-civil liberties "Candidate Obama" and the just as eloquent, anti-constitutional authoritarian, President Obama.

Senator Obama branded the Patriot Act "shoddy and dangerous" and pledged to end it in 2003. In 2005, he pledged to filibuster a Bush-sponsored bill that included several of these exact components recently extended, calling them "just plain wrong" in a Senate speech. He argued:

"Government has decided to go on a fishing expedition through every personal record or private document -- through library books they've read and phone calls they've made...We don't have to settle for a Patriot Act that sacrifices our liberties or our safety -- we can have one that secures both." It goes without saying, Obama reneged on those pledges.

But now let's hear from President Obama, who wrote in a letter that he was advocating IN FAVOR of the most abusive provisions in the Act to stand...the same ones he claimed were "shoddy and dangerous" as a Senator.

For instance, business and citizens groups can still have their records examined by the government with minimal checks on how the information can be used and more particularly used against. Individuals often based on flimsiest of evidence can still be targeted for monitoring and surveillance if suspected of being a potential terrorist.

Organizations and individuals can still be slapped with so-called roving wiretaps (taps that can be placed on an individual or group anywhere, anytime) again based on weak evidence or unfounded suspicion....

Now President Obama justifies keeping nearly all of Bush's terror war provisions in place with the standard rationale that the government must have all the weapons needed to deal with the threat of terrorism. If you think I'm confusing Bush and Cheney with Obama, sadly, you're wrong.

Then there was the Administration's radical interpretation and use of the "state secrets" privilege to block courts from hearing a host of information, from torture allegations to wiretapping claims. In other words, for the sole purpose of protecting those that committed crimes that the President vehemently criticized as a Senator and promised to address as a candidate.

And finally, for today's purposes anyway, we now know that the Administration is going along - in most respects - with the Bush policies of indefinite detention and military tribunals.

So, forgive me if I'm not surprised by today's article in the American Prospect. Julian Sanchez reports:

Here's how it was supposed to be. Under his administration, candidate Barack Obama explained in 2007, America would abandon the "false choice between the liberties we cherish and the security we provide." There would be "no more National Security Letters to spy on citizens who are not suspected of a crime" because "that is not who we are, and it is not what is necessary to defeat the terrorists." Even after his disappointing vote for the execrable FISA Amendments Act of 2008, which expanded government surveillance power while retroactively immunizing telecoms for their role in George W. Bush's warrantless wiretapping, civil libertarians held out hope that the erstwhile professor of constitutional law would begin to restore some of the checks on government surveillance power that had been demolished in the panicked aftermath of the September 11 attacks.

The serial betrayal of that hope reached its culmination last week, when a Democratic-controlled Congress quietly voted to reauthorize three controversial provisions of the USA Patriot Act without implementing a single one of the additional safeguards that had been under consideration -- among them, more stringent limits on the national security letters (NSLs) Obama had once decried. Worse yet, the vote came on the heels of the revelation, in a blistering inspector general's report, that Obama's Office of Legal Counsel (OLC) had issued a secret opinion, once again granting retroactive immunity for systematic lawbreaking -- and opening the door for the FBI to ignore even the current feeble limits on its power to vacuum up sensitive telecommunications records.

...

But as a detailed report released last month by the office of the inspector general (OIG) revealed, between 2003 and 2006, the FBI sought to stretch its NSL powers beyond even these ample boundaries. Investigators obtained thousands of records from telecommunications providers using a made-up process called an "exigent letter" -- which essentially promised that a proper NSL would be along shortly. Among those whose records were obtained in this way were reporters for The Washington Post and The New York Times -- in violation of both the law and internal regulations requiring that the attorney general approve such requests.

...

Following standard practice, the OIG sent a draft copy of its report to the FBI for comment before publication. Understandably distressed by the watchdog's finding that analysts had broken the law repeatedly and systematically over a period of years, FBI attorneys scrambled for retroactive cover. As a heavily redacted section of the report explains, they hatched a novel theory, according to which some broad class of records was actually exempt from the requirements of the ECPA, and therefore eligible to be handed over "voluntarily" by the telecoms. Even in the freewheeling days of the Bush administration, apparently, nobody had come up with this particular rationalization for evading federal privacy statutes -- but it would still serve as a retroactive excuse if Obama's Office of Legal Counsel could be persuaded to bless the new reasoning.

Shamefully, the OLC appears to have done just that in a secret opinion issued in January, just weeks before the publication of the OIG report. While it's impossible to know the precise scope of this novel legal loophole -- sufficiently clever parsing of the statutory definition of "subscriber" or "record" might generate a good deal of wiggle room -- the OIG stressed that this freshly discovered power "has significant policy implications that need to be considered by the FBI, the Department, and the Congress." It was a page straight from the John Yoo playbook: When intelligence agencies are discovered to have broken the law, simply reinterpret the law!

Click here to be increasingly disturbed.

Frankly, I'm running out of words and ways to express the degree of my discontent. Not just with this Administration of course, but with the increasing public acceptance, or at least apathy, when it comes to issues related to privacy and the constitution. It just feels like the slap in the face is a bit harder when it comes from a supposed "liberal" Constitutional Law professor.

I understand the pressures and powers (actually, probably don't fully) that must be at play once President. The military industrial complex, the intelligence community, the constant fearmongering from the right wing, and a corporate media that covers everything in a black and white, distorted haze, must represent a source of incredible pressure to "play the game". And that means, continue to abuse power.

As I used to write back in the dark days of the Bush Administration, just because a new President was coming into power, that by no means meant that ANY POWERS Bush first abused then claimed as his right, would be given up. As we know, its much more difficult to give up power once it has been given. And boy are we seeing that now...

Patriot Act Renewal, Whole-Body-Imaging, and Cell Phone Tracking

In my effort to deal with the two pronged problem of having no time AND finding three important privacy related stories to discuss today, I'm just going to include some links and info on each topic in one post.

The Patriot Act Extended by the Senate

That's right...the DEMOCRATIC Senate not only voted to renew one of the most egregious legislative assaults on the Constitution ever enacted - a law Democrats promised to reform if not outright end - but what few privacy protections that had recently been added were stripped at the last minute. My "outrage meter" is broken from overuse in recent months.

I have written in painstaking detail about this Act, and the Senate Judiciary Committee's initial attempts to improve it. In fact, I was extremely critical of it BEFORE what few additional protections were stripped!

Instead, the Senate voted to reauthorize three expiring provisions of the Patriot Act adopted just after the September 11th attacks. As I wrote in the past, also not widely reported was the fact that President Obama worked behind the scenes to ensure that absolutely no meaningful reforms to the Act were adopted...essentially a complete reversal of his positions as a Senator and Presidential candidate.

Though Senators Feingold and Durbin put up an admirable fight on a variety of fronts in Committee, it approved allowing broad warrants to be issued by a secretive court for any type of record, from financial to medical, without the government having to declare that the information sought is connected to a terrorism or espionage investigation.

The Senate also renewed the so-called “roving wiretap” provision, allowing the FBI to obtain wiretaps from the secret court, known as the FISA court, without identifying the target or what method of communication is to be tapped.

Finally, the so-called “lone wolf” measure that allows FISA court warrants for the electronic monitoring of a person for whatever reason — even without showing that the suspect is an agent of a foreign power or a terrorist was also approved.

The already very limited privacy protections that were agreed upon by the Judicial Committee that were dropped were the requirement that the government publish audits, including how many times the Patriot Act’s provisions were used, including the number of targets. Much of the government’s public reporting on the topic has been voluntary, and very little is known about how often each power has been used and why.

Another change centered on library records. In order to obtain warrants for them from the FISA court, the new plan requires a tangential connection to a terror investigation or foreign power. The expiring version does not.

The Judiciary Committee bill would also have restricted FBI information demands known as national security letters and made it easier to challenge gag orders imposed on Americans whose records are seized.

And want to know the excuse offered by Senator Leahy why even those modest protections didn't make it into the final product? Get a vomit bag read, he said ""I would have preferred to add oversight and judicial review improvements to any extension of expiring provisions in the USA Patriot Act. But I understand some Republican senators objected."

God forbid protecting the Constitution and the privacy of the American people if some Republicans object!!

Congress to Address Cell Phone Tracking

Here's another topic I've been zeroing in on a lot lately. As I wrote just two weeks ago, the issue at hand is over what the proper legal standard should be when prosecutors demand cell phone location data.

A little case history first: Last April, the Washington Post reported that while serving as a U.S. attorney during the Bush administration, Christopher Christie tracked the whereabouts of citizens through their cell phones without warrants. The ACLU obtained these documents from the Justice Department in an ongoing lawsuit over cell phone tracking. While the documents reveal 79 such cases on or after Sept. 12, 2001, they do not specify how many of the applications were made during Christie's tenure.

Tracking without a warrant disregards an internal U.S. Justice Department recommendation that prosecutors obtain probable cause warrants before gathering location data from cell phones. Of the cases in which probable cause wasn't established, documents showed 19 allowed the most precise tracking available. Those cases occurred after the November 2007 Justice Department recommendation that prosecutors seek warrants.

Documents released by the ACLU have also shown that of the states randomly sampled, New Jersey and Florida used GPS tracking without obtaining probable cause or warrants. Four other states, California, Louisiana, Indiana, Nevada and the District of Columbia reported having obtained GPS data only after showing probable cause.

Those documents were part of the ongoing lawsuit by the ACLU and Electronic Frontier Foundation on how the government tracks cell phone users. As these two privacy protection stalwarts argued in those cases, government tracking without a probable cause or warrant is a violation of the Constitution's Fourth Amendment, which guards against unreasonable search and seizure. Government prosecutors have argued that only a court order showing the tracking data is relevant to a criminal investigation is needed.

On that front, Congressional hearings regarding impending privacy legislation typically have focused on behavioral ad targeting, but location-based mobile targeting could be regulated, too. Two congressional subcommittees met this morning to discuss location-based technologies and their impact on consumer privacy and safety.

From ClickZ.com: Several witnesses agreed that use of location-based mobile data must be dealt with by privacy legislation expected to be proposed sometime this year. Among their concerns is the need for privacy controls to not only be present, but easily accessible to consumers. The familiar phrase of "notice and consent" - one that's become common during hearings on behavioral ad targeting - was mentioned throughout the discussion.

While some lawmakers cautioned that any new rules must not hamper industry innovation or benefits of geographic data usage to consumers, at least one legislator suggested personal privacy is more important than business in some cases.

But perhaps of more interest, was an article in Truthout.org entitled Cell Phone Tracking: The New Constitutional Crisis. William Fisher writes:

If you own a cell phone, you should care about the outcome of a court case that "could well decide whether the government can use your cell phone to track you - even if it hasn't shown probable cause to believe it will turn up evidence of a crime."

That was the warning issued to the public by several major civil liberties organizations as they appeared in federal court in Philadelphia to argue for more privacy protections in the use of cell phones as tracking devices by law enforcement agents.

The case is at the heart of the constitutional crisis now being played out in the US federal court. Civil liberties groups are asking the court to require that the government show probable cause before it can track your whereabouts.

...

The plaintiffs in the court case hope the court will "send a message that merely carrying a cell phone should not make people more susceptible to government surveillance." They add, "No one wants to feel as if a government agent is following her wherever she goes - be it a friend's house, a place of worship, or a therapist's office - and innocent Americans shouldn't have to feel that way."

The government has argued that "One who does not wish to disclose his movements to the government need not use a cellular telephone." But the civil liberties groups say this is "a startling and dismaying statement coming from the United States. The government is supposed to care about people's privacy. It should not be forcing the nation's 277 million cell-phone subscribers to choose between risking being tracked and going without an essential communications tool."

...

Two years ago, a US magistrate in Pittsburgh ruled that the data they were seeking could easily be misused to collect information about sexual liaisons and other matters of an "extremely personal" nature.

In federal appeals court last week, a Justice Department lawyer urged the judges to overturn the magistrate's ruling. They claimed the government was seeking "routine business records."

But after one of the judges said there were some governments, like Iran's, that would like to use such records to identify political protesters, she asked whether the "government can assure us" that the Justice Department would never collect cell-phone data for this kind of use in the US. The government lawyer grudgingly acknowledged that such data "could be used constitutionally."

EPIC wants TSA to halt implementation of body scanners at airports

FROM ZDNET: In a letter sent to the White House, the Electronic Privacy Information Center (EPIC) President Marc Rotenberg, along with Ralph Nader, request that body scanner technology be halted until several health, safety and privacy issues are resolved.

Body scanner devices have been deployed at 18 different airports in the U.S. and should be implemented at all international airports by the end of this year. One of the key concerns EPIC has is privacy and how images could be stored. The same issues were raised in Canada during pilot testing of similar body scanning devices. In a Privacy Impact Assessment (PIA), investigators asked many of the same questions EPIC is concerned with.

You can also read my article, "The Politics of Fear and "Whole-Body-Imaging"

EPIC Urges Court to Block Google Book Deal

Before I get to the latest on the Electronic Privacy Information Center's (EPIC) court filings urging a judge to block the deal struck with Google books months ago, let's refresh all of our minds on what the privacy principle is that we're fighting over here (with Google of course).

The ACLU does a good job framing the issue in their Google Book search campaign: What you choose to read says a lot about who you are, what you value, and what you believe. That’s why you should be able to learn about anything from politics to health without worrying that someone is looking over your shoulder. The good news is that millions of books will be available for browsing and reading online. The bad news is that Google is leaving reader privacy behind. Under its current design, Google Book Search can monitor the books you browse, the pages you read, and even the notes you take in the "margins." Without strong privacy protections, all of your browsing and reading history could be collected, analyzed, and turned over to the government or third parties without your knowledge or consent.

As I wrote last year: we're not talking about just another library mind you - librarians utilize a different standards for dealing with user information than does the online world. Many libraries routinely delete borrower information, and organizations such as the American Library Association have fought hard to preserve the privacy of their patrons in the face of laws such as the U.S. Patriot Act.

The concerns of privacy advocates are not hypothetical - nor should they be discarded as paranoia. Our country has a long history of government efforts to compel libraries and booksellers to turn over customer records and information.

Why would anyone believe, particularly after the warrantless wiretapping scandal, that the government won't ask a company like Google to turn over the treasure trove of private personal information it has on millions of Americans? For these reasons and more, it is essential that Google Book Search incorporate strong privacy protections.

It wasn't more than a few months ago that the Electronic Frontier Foundation (EFF) along with the ACLU and the privacy authors and publishers they represent, which include the American Library Association, the Association of Research Libraries and the Association of College and Research Libraries, CDT, EPIC, SFLC, Professor James Grimmelman sent a joint letter to Google urging it to include privacy protections along with its reconsidered Google Book Search Settlement.

A key passage from the letter reads:

As you know, the failure of the settlement to ensure that readers using the Google Book Search services will have their privacy protected as much as readers using physical books has been a key concern for many authors, libraries and the reading public.

It is the basis for some objections to the settlement, but has also been raised as a concern by those who support the settlement. As author Jonathan Lethem put it, “now is the moment to make sure that Google Book Search is as private as the world of physical books. If future readers know that they are leaving a digital trail for others to follow, they may shy away from important but eccentric intellectual journeys.”

While we appreciate the statements made in the privacy policy released in early September, that policy does not go far enough. We believe that it is vital that Google commit to additional privacy protections and that such commitments be enforceable by the court presiding over the settlement. The Electronic Frontier Foundation, the Center for Democracy & Technology, and the Electronic Privacy Information Center in their respective briefs have offered recommendations, many of which are quite similar, and would be happy to assist you in navigating any real or perceived differences between them.

As the plaintiffs’ motion correctly notes, “depending on the contours of the amended settlement agreement, some objectors may no longer object and would choose not to travel to New York at all for the hearing.” Providing real, enforceable privacy protections may help reduce the number of objections that the court must consider as the case moves forward.

That leads me to today's post, and what appears to be, but not a shock to anyone that follows the "privacy issue", Google's failure to adequately address advocates concerns.

Doug Hanchard of ZDNet writes:

As the negotiations continued throughout 2009 to the present day, EPIC has consistently voiced serious concerns on how the agreement has ignored several key issues concerning privacy of potential users of the service. Today’s press release is no exception.

In federal district court in New York, EPIC President Marc Rotenberg urged Judge Denny Chin to reject the revised settlement now before the court in Authors Guild v. Google. Mr. Rotenberg said that the settlement would “turn upside down” well established safeguards for reader privacy, including state privacy laws, library confidentiality obligations, and the development of techniques that minimize privacy intrusions. Mr. Rotenberg warned that the settlement would eviscerate legal safeguards for library patrons, commercialize access to information, consolidate Google’s control of the Internet, and put in place an elaborate system of user authentication and watermarking. “A person at any library or any university in the United States that attempted to retrieve information from Google’s digital library would be uniquely tagged and tracked. There is simply no precedent for the creation of such power.”

...

EPIC’s arguments warrant serious consideration by the court. Copyright issues can be fairly negotiated between Google and authors. EPIC believes that component is but a small part of the overall program that Google Books unleashes. At stake is the monitoring of our reading habits, what information sources we use, what’s popular and even how often we read. This data translates into information that has commercial value and has potential to influence in what we read and have in our collection of books. This may lead to future consequences that surprise us. A hypothetical example is what we read becomes analyzed and (eventually) be revenue generating by making specific items available - at a surcharge. These surcharges will be aimed specifically at you and you alone. Google will have information that reviews what your specific reading taste are, and if you want more books related to Google analyzed reading habits, Google potentially has the ability to strategically market and sell books and services that cater and maximize potential future purchases you make.

I'll just go back to my initial post on this subject about a year ago:

...it is essential that Google Book Search incorporate strong privacy protections. Without such protections, we're talking about a virtual one-stop shop for government and third party "fishing expeditions into the personal details of our lives." Again, these concerns are not hypothetical.

Just three years ago the U.S. attorney subpoenaed Amazon for the used book purchase records of over 24,000 customers in the course of a grand jury probe investigating a single individual. The good news was a federal judge agreed that Amazon should not have to turn over this information about its customers, saying that if word spread over the Internet that the federal government was probing book purchase information , “the chilling effect on e-commerce would frost keyboards across America."

If there ever was a time to make sure that Google doesn't put an end to reader privacy as we know it would be now. At present, all Google has done is make a lot of informal statements about privacy, while failing to provide an actual privacy policy with specific promises to consumers.

More on The Smart Grid and Privacy

I've written quite extensively on the growing debate over smart electricity meters and the potential threat they pose to privacy (if we don't take the proper precautions). To read any or all of those, just click here.

At this moment, Public Utilities Commission's (PUC) across the country are considering how to implement such a grid, and in response to a rulemaking by the California PUC, and the lack of attention being paid to the concerns of privacy advocates to date on this issue, the Consumer Federation of California (CFC) recently joined The Utilities Reform Network (TURN) in urging the Commission to allow for a more comprehensive review and debate regarding such concerns.

For today, I noticed an article from a Canadian news site called CBN News, entitled Smart grid could turn appliances into spies, experts warn" that I want to share.

Paul Gallant reports:

Do you want your fridge talking about you behind your back?

With the rapid adoption of a North American "smart grid" aimed at helping consumers conserve electricity, it's also possible that smart appliances will be able to transmit information about their activities (and yours) through the power lines. Your electricity utility may not yet be able to determine when you snack, do laundry or shower, but privacy advocates are sounding the alarm that systems need to be put in place to guard details about a household's electricity usage from prying eyes.

...

In its most basic form, the smart grid allows utilities to read meters without sending out an employee; instead the meters send a reading back to the utility automatically. But Ontario's push into smart meters has been aimed at changing consumer behaviour, so the launch in that province goes further.

...

Many households with smart meters can already go online and log in to an energy-use account to see how much energy they used during a specific time period. By giving people more detailed information about their electricity usage, the assumption is that they will be willing to reduce their consumption or re-schedule it to off-peak hours when the rate may be cheaper.

...

Things get trickier from a privacy perspective if the system offers real-time statistics, since electricity use is a good indication of whether someone is at home at that very moment and what they are doing - if they're awake or asleep, for example.

Eventually, utilities will have the ability to allow consumers to see how their energy use compares to that of their neighbours, information that, if not sufficiently protected, could reveal many things about your neighbours' comings and goings as well.

Utilities promise this data will be encrypted and assigned an anonymous number that can't be tracked back to an individual customer. But the cyber security co-ordination task group that has been addressing smart grid privacy concerns in the U.S. has warned, "there is a lack of formal privacy policies, standards, or procedures by entities who are involved in the smart grid and collect information." It added that, "comprehensive and consistent definitions of personally identifiable information do not generally exist in the utility industry."

...

Hydro One has policies in place that prohibit it from selling customer information to third parties. But the pressure for third-parties to access power-usage information will only increase.

Many companies are working on new products — electric vehicles, smart appliances and energy-production systems like solar panels — that have the potential to take advantage of the smart grid's two-way communication system to send usage information from individual appliances and devices to a central office where it can be accessed by the utility or by the user. Whirlpool Corp., for example, announced in January it would produce one million smart appliances by the end of 2011 and make all its appliances smart grid-compatible by the end of 2015.

Device-specific information would be useful to the consumer to get credit, for example, if they were feeding electricity back into the grid from solar panels or a windmill. Some appliances could adjust their own energy consumption according to the time of day or by monitoring what other appliances were running in the home.

This kind of information could help make a home more efficient in terms of energy consumption, but it would also be tempting information for marketers, governments and even thieves. The Future of Privacy report suggests that extensive information could be gleaned from the grid — everything from when you shower or watch TV to which appliances and gadgets you have in your home, and when you use them.

The report urges that any third-party access to the information should not be a deal between the utilities and the third parties, but between the consumers and the third parties. As well, third parties should agree not to correlate data with data obtained from other sources or the individual, without the consent of the individual.

Click here to read more.

For more information on this subject, and more of my thoughts, check out my article The Privacy Implications and Challenges of a Smart Grid Electrical System.

Google Buzz...Here We Go Again...Yet Another Privacy Debacle

Another day, another Google privacy debacle. For every post - and there have been A LOT OF THEM - regarding Google's latest product that treats privacy as its personal whipping boy, I have to republish my usual caveat:

Anyone that has read this blog knows I have written a number of posts about Google's confrontational relationship with privacy, and the variety of ways this can be demonstrated in a host of its products. I've written about the approaching launch of Google Books just around the corner in which the ACLU, Electronic Frontier Foundation, and the Samuelson Clinic have even launched a Google Book Search privacy campaign to address.

I've written about the loss of "Locational Privacy" and how a host of Google products relate to that growing privacy protection challenge. And I've posted a lot about other examples demonstrating Google's less than stellar record on privacy in the past, from their lobbying efforts in Congress, to cloud computing, and to its increasing usage and expansion of behavioral marketing techniques.

Then, there was last week's news that Google - the world's largest and ever expanding privacy allergic technological empire - had enlisted the National Security Agency (the agency responsible for such privacy violation greatest hits as warrantless wiretapping) for technical assistance. Oh Joy!

But apparently Google wasn't through! I speak of Google's big release of their latest innovation "Google Buzz", and the subsequent outcry from privacy advocates, and the now official apology from Google.

Let's give a little back story. First, the technology itself. As described by out-law.com:

Google Buzz is the search giant's attempt to convert its Gmail service into a social network, but it has alienated many users by mining personal information in other Google-run services to boost Buzz usage.

When it was launched last week Buzz was set to automatically use information from people's Google web mail accounts and RSS-reading Reader service in a bid to kick-start the service.

It automatically signed users up to 'follow' the Buzz activity of the people they communicated with most on Gmail and connected followers to items shared by a user through the Reader service.

The company was accused not only of violating users' privacy but of burying the mechanism to change the settings in an obscure part of the service's menus. It has twice modified the service in a bid to allay users' concerns.

Google first made the option for switching off the auto-follow more prominent, then changed it altogether so that it only suggested people a user might like to follow.

Since last week's initial release of the new "service", Google has received, and now responded to, a whole lot of criticism (i.e. Google now asks Buzz users to manually approve their followers instead of automatically including them on their Buzz lists, and improved the visibility of the privacy controls).

So I guess the first question that comes to mind is how did Google - a company with a seemingly endless supply of bright minds working there - bungle this project so badly?

C-Net's Tom Krazit has the scoop:

Buzz was just tested inside Google before it launched to the general public, said Todd Jackson, Google Buzz product manager. Several layers of Google employees participated in the process, from the initial design team to wider and wider circles of employees. And a source familiar with the product development process said Google put Buzz through its usability lab, where it brings in outsiders to evaluate products in secret before they are launched.

However, either no one brought up the privacy concerns that Buzz users raised within a day of its launch, Google didn't ask the outsiders for the thoughts on Buzz privacy, or Google engineers dismissed those concerns as unfounded. For whatever reason, Google has taken a hit over the Buzz launch from a public that is already skeptical about the search giant's motivations with the enormous amount of personal data it already has accumulated.

...

...the incident exposes a real problem for Google: does its unique culture really understand the markets in which it wants to participate?

Social media has already been a minefield for Google, with stops and starts amid charges that the engineers who built Google don't understand the wider world of social networking. Fairly or unfairly, incidents such as the Google Buzz launch underscore that Google employees--among the smartest and most tech-savvy group of workers in Silicon Valley--may not be the best testing ground for products designed to reach the general public.

Google is famous--infamous, really--for keeping products in "beta" mode for an inordinate amount of time while they work out the kinks. Gmail--the host product for Google Buzz--was in beta for five years, with Google unwilling to lift the qualifier tag until last year amid a push into corporate accounts.

The company also tests products through invitation-only groups, such as it did for Google Voice and Google Wave. Then, over time, it opens those groups to wider and wider circles until the general public is welcome.

But when it came to making that decision for Google Buzz, the company decided that social networks only really start to become compelling when a user has a lot of contacts, according to a source familiar with its thinking. Therefore, it wanted to seed Buzz users with as many contacts as possible when they first logged into the system, so they could get up and Buzzing right away.

As I mentioned, apparently Google at least did get the "get your sh** together" memo this time, as the company moved quickly over the weekend to try to contain this public relations disaster by first apologizing to users for features that endangered the privacy of its customers and announcing product changes to address those concerns - such as instead of automatically connecting people, in the future Buzz will merely suggest to new users a group of people they may want to follow or be followed by.

Still, what's astonishing to me is this wasn't done BEFORE the service went live! My god...this should be basic privacy 101 stuff, shouldn't it????

Generally, the reaction by privacy advocates to these changes has been mildly positive.

AS the New York Times reports:

Some critics said the latest modifications to Buzz, which is tightly coupled with Gmail, appeared to have addressed the most serious privacy concern.

“Turning off the auto-follow was a huge improvement,” Danny Sullivan, a longtime Google analyst and the editor of SearchEngineLand, said in an e-mail message.

But Marc Rotenberg, executive director of the Electronic Privacy Information Center, said his organization still intended to file a complaint with the Federal Trade Commission this week pending its review of Google’s changes.

“Even with these changes, there is still the concern that Gmail users are being driven into a social networking service that they didn’t sign up for,” Mr. Rotenberg said in an interview on Sunday.

The privacy concerns about Buzz, and Google’s rapid efforts to address its critics, echo episodes that have bedeviled other social networks, most notably Facebook. None of those events have slowed the growth of Facebook, which recently said it had reached more than 400 million users. Gmail has 176 million users, according to the research firm comScore.

“I think the privacy issues earlier this week with Buzz will blow over and not harm the product in the long term,” Mr. Sullivan said. But privacy will continue to haunt Google, he said, and many people will point to the release of Buzz as an overreach by Google and a reason that the company could not be trusted.

...

Google also said that it would create a new Buzz tab in Gmail’s settings page to allow users to hide Buzz from Gmail completely. The page gives users the option to disable Buzz, deleting their posts and removing their Google profile, which in many cases listed publicly their circle of contacts in Buzz. The new feature could address concerns that disabling Buzz and removing a public profile was a multistep process that confused many users and that some described as a game of whack-a-mole.

Google also will no longer automatically connect public Picasa albums and items shared on Google Reader, another feature that had been widely criticized by some users and privacy advocates.

Click here to read more of the Times article.

So what should we take away from this latest Google privacy debacle? Certainly, the company seems to remain completely tone deaf on the issue of privacy, but at the same time, it did respond quicker and more thoroughly to criticisms.

In all, I think Tom Krazit of C-Net hits the nail on the head:

With all the scrutiny on Google these days, however, it appears that the time is ready for privacy to become as important a part of Google's product design philosophy as the placement of pixels. Google says it takes this responsibility very seriously, but despite including tens of thousands of Googler on pre-launch Buzz testing, the privacy mistakes still slipped through the cracks.

How can Google avoid making these mistakes in the future?

For one, the company needs to make sure it strikes a better balance between internal and external feedback. It's understandable that Google would prefer to test things with its own employees to prevent product leaks, but unless Google wants to invest in ethnographers and social scientists to balance the engineers, it will need to solicit outside feedback to make sure it understands the needs of regular people.

Also, Google does not have a chief privacy officer listed as part of its operating committee, and the word "privacy" does not appear in the job description of any of the dozens of top executives listed on Google's management page.

A company representative said that Google has chosen a strategy where "rather than having a single, isolated privacy department, here at Google we embed the importance of privacy into our products and systems from engineers through executives, guided by trained privacy professionals." However, despite that focus, the privacy controls in Google Buzz were deemed adequate by those people.

That can't happen again: Google simply can't afford to make any more mistakes regarding privacy. Otherwise, it will start to lose the trust of its users, who have been reminded for years that the competition is just a click away.

I think Google would do well to take heed to the advice of Mr. Krazit. Time will tell....