The Rise (and Costs) of the American Surveillance State

The rising costs and scope of today's surveillance state has garnered some much needed attention over the past week, with two quality investigative pieces in the Los Angeles Times, an excellent op-ed by Sarah Jaff on Alternet, and the usual brilliant analysis from Salon.com's Glenn Greenwald. So, I want to briefly navigate some of these articles (and ling to them of course) for you today because I really think it strikes at the heart of what is a very real crisis in this country: the deterioration of privacy and the evisceration of the bill of rights....all under the FALSE guise of "protecting us from terrorism".

I coined a term for this burgeoning security state (and those that "sell it") two years ago as the "Fear-Industrial-Complex", (i.e. Department of Defense, corporate media, talk radio, security technologies industry, Congress, the White House, “the intelligence community”, pundits, weapons/defense contractors, etc.).

Unfortunately, as we approach the 10th anniversary of 9/11, "Terror hysteria" remains a powerful tool to bludgeon the public with in order to rationalize and defend the continuing assault on privacy and civil liberties. Fear, as we all should be very aware of by this time, as it defines our post 9/11 security state, is quite effective in convincing the population they need protection from next to non-existent threats...even when it means relinquishing core constitutional rights.

To this day, the same interests that took advantage of 9/11 to ram through the Patriot Act are out in force - aided this time by a much more influential and powerful “security industry”. And of course, advancements in security technology may serve certain important purposes in specific situations, but more often than not, represent the continuing expansion of Big Brother's ability to monitor and record nearly everything we do - usually under the guise of "keeping us safe".

As I will illustrate today, its not just the loss of privacy that accompanies this surveillance state that is so destructive. In fact, at times of draconian austerity measures being forced on a public already struggling to make ends meet, its the costs of this security state that should also give us pause.

Before I give some of those numbers, we should remember that any meaningful debate over whether we need MORE surveillance and monitoring, be it wiretapping, street cameras, airport body scanners, or internet spying and storage, we might want to ask the question whether such technologies actually make us safer (i.e. are there documented incidences they have led to capturing terrorists plotting against us?)? Two, is there any evidence that they have been abused (or in fact, are they not being used to catch terrorists at all)? Three, is their claimed usefulness somehow jeopardized by the kinds of modest reforms privacy rights groups (and others) advocate? And finally, are we creating dangerous constitutional precedents?

As I have written about numerous times on this blog, there is little to no evidence that the massive expansion of the security state since 9/11 has made us any safer. Yet there’s a long list of incidences of unadulterated government abuse and malpractice for a host of purposes other than fighting terrorism. In other words, the threat this Act, and these particular provisions pose to the basic Constitutional rights of American citizens is not hypothetical, but documented fact.

So let's get to what the Los Angeles Times pieces discovered before we get to some interpretations from Greenwald and Jaff. All I would ask is that while its true, spending "inefficiencies" of this massive security state are important, what's more so is that we must come to realize that its not meant to even fight terrorism... its the security spending and the power it provides the state/corporations itself that is the goal. Terrorism is the marketing ploy to keep this well oiled money and power machine running, and that's all. 

Here's some of what the Los Angeles Times found:

Is Homeland Security spending paying off? A decade after the Sept. 11, 2001, attacks on the World Trade Center and the Pentagon, federal and state governments are spending about $75 billion a year on domestic security, setting up sophisticated radio networks, upgrading emergency medical response equipment, installing surveillance cameras and bombproof walls, and outfitting airport screeners to detect an ever-evolving list of mobile explosives. One effect is certain: Homeland Security spending has been a pump-primer for local governments starved by the recession, and has dramatically improved emergency response networks across the country. An entire industry has sprung up to sell an array of products, including high-tech motion sensors and fully outfitted emergency operations trailers. The market is expected to grow to $31 billion by 2014.

The expensive and time-consuming screening now routine for passengers at airport boarding gates has detected plenty of knives, loaded guns and other contraband, but it has never identified a terrorist who was about to board a plane. Only 14 Americans have died in about three dozen instances of Islamic extremist terrorist plots targeted at the U.S. outside war zones since 2001 — most of them involving one or two home-grown plotters. 

The spending has been rife with dubious expenditures, including the $557,400 in rescue and communications gear that went to the 1,500 residents of North Pole, Alaska, and a $750,000 anti-terrorism fence — fashioned with 8-foot-high ram-proof wrought iron reinforced with concrete footers — built around a Veterans Affairs hospital in the pastoral hills outside Asheville, N.C.

Now, this list goes on and on, but you get the gist...there's a lot of waste....which reinforces the point I'm making...

But let's get to the second Los Angeles Times piece 

The LA Times reports: 

Advocates say the expanded surveillance has helped eliminate vulnerabilities identified after the Sept. 11 attacks. Some critics, unconvinced, say the snooping undermines privacy and civil liberties and leads inevitably to abuse. They argue that the new systems have weakened security by burying investigators in irrelevant information.

A robust debate on the intelligence gathering has been impossible, for the simple reason that most of the activity is officially secret. In lawsuits alleging improper eavesdropping, the Justice Department has invoked state secrecy to prevent disclosure of classified information and systems.

In May, two members of the Senate Intelligence Committee said that Americans would be disturbed if they knew about some of the government's data-gathering procedures. But Sens. Ron Wyden (D-Ore.) and Mark Udall (D-Colo.) said they were prohibited from revealing the facts.

Courts have ruled that the government doesn't need a search warrant, which requires a judge's approval, to obtain records held by "third parties," such as hotels, banks, phone companies or Internet providers.  So the government has used National Security Letters to get the data, issuing 192,500 of the letters between 2003 and 2006, according to an audit by the Justice Department inspector general. The numbers have dropped sharply since then, but the FBI issued 24,287 National Security Letters last year for data on 14,212 Americans. That's up from a few thousand letters a year before 2001.

"It used to be the case that if the government wanted to find out what you read and what you wrote, it would have to get a warrant and search your home," said Daniel J. Solove, a law professor at George Washington University and the author of numerous books and articles on privacy law.

Now, "it just obtains your Amazon purchase records, your Facebook posts, your Internet browsing history — without you even knowing." "I think it's a world of difference between what a person decides to post publicly and what the FBI collects about them secretly," said Gregory Nojeim, senior counsel at the Center for Democracy & Technology, a Washington-based civil liberties group.

Bush gave the NSA the authority to eavesdrop on Americans communicating with foreigners abroad without first obtaining a FISA warrant, deeming the process too slow. As a U.S. senator, Obama condemned the so-called wireless wiretapping after the New York Times made it public in 2005. But when he ran for president in 2008, Obama voted for legislation that granted retroactive legal immunity to telecommunications companies that had secretly helped the government eavesdrop.

The law also retroactively legalized other forms of surveillance, former intelligence officials say, including "bulk" monitoring that allows the government to intercept all email traffic between America and a range of suspect email addresses in, say, Pakistan.

Privacy advocates say the government should acknowledge how many Americans have had their communications intercepted in recent years. But after Democrats on the House Intelligence Committee requested that information, the Obama administration responded in July that it was "not reasonably possible to identify the number." 

You can read more here.

Now, let's get to some of the analysis from Glenn Greenwald of Salon.com, then I'll get to Jaffe who makes the case that the surveillance state also serves to protect the interests of the wealthy elite...which is yet another function of the security state.

But I want to focus on some of Greenwald's points, assertions I have made on this blog quite often too...and that's just how LITTLE of a terrorist threat there really is, and just how totally out of whack our fears are with reality itself. Greenwald writes:  "The number of people worldwide who are killed by Muslim-type terrorists, Al Qaeda wannabes, is maybe a few hundred outside of war zones. It's basically the same number of people who die drowning in the bathtub each year," said John Mueller, an Ohio State University professor who has written extensively about the balance between threat and expenditures in fighting terrorism.

Last year, McClatchy characterized this threat in similar terms: "undoubtedly more American citizens died overseas from traffic accidents or intestinal illnesses than from terrorism."  The March, 2011, Harper's Index expressed the point this way: "Number of American civilians who died worldwide in terrorist attacks last year: 8 -- Minimum number who died after being struck by lightning: 29."  That's the threat in the name of which a vast domestic Security State is constructed, wars and other attacks are and continue to be launched, and trillions of dollars are transferred to the private security and defense contracting industry at exactly the time that Americans -- even as they face massive wealth inequality -- are told that they must sacrifice basic economic security because of budgetary constraints

....

...while the Security State has little to do with addressing ostensible Terrorist threats, it has much to do with targeting perceived domestic and political threats, especially threats brought about by social unrest from austerity and the growing wealth gap...the prime aim of the growing Surveillance State is to impose domestic order, preserve prevailing economic prerogatives and stifle dissent and anticipated unrest.

...

Exaggerating, manipulating and exploiting the Terrorist threat for profit and power has been the biggest scam of the decade; only Wall Street's ability to make the Government prop it up and profit from the crisis it created at the expense of everyone else can compete for that title.  Nothing has altered the mindset of the American citizenry more than a decade's worth of fear-mongering.  So compelling is fear-based propaganda, so beholden are our government institutions to these private Security State factions, and so unaccountable is the power bestowed by these programs, that even a full decade after the only Terrorist attacks on U.S. soil, its growth continues more or less unabated.

Click here to read more.

Now let's get to the piece by Sarah Jaff entitled "How the Surveillance State Protects the Interests Of the Ultra-Rich", because I think there is NO ISSUE today that shouldn't be viewed through the prism of the class war, namely that of the corporate and wealthy elite against just about everyone else. Now, that's not to say some issues don't involve class, but that's usually because they are being used to DISTRACT us from the class issue, namely the widening gap between the rich and poor.

And in fact, this growing, expensive, and invasive surveillance state is yet another tool in the arsenal of the elites. Jaff writes, "The techniques that were roundly decried by Western leaders when used by Egyptian president Hosni Mubarak against his people's peaceful revolution are suddenly embraced when it comes to unrest at home. Not only that, but techniques honed in the “war on terror” are now being turned on anti-austerity protesters, clamping down on discontent that was created in the first place by policies of the state.

Glenn Greenwald noted this connection in a recent piece, writing:

“The last year has seen an incredible amount of social upheaval, not just in the Arab world but increasingly in the West. The Guardian today documented the significant role which poverty and opportunity deprivation played in the British riots. Austerity misery -- coming soon to the U.S. -- has sparked serious upheavals in numerous Western nations. Even if one takes as pessimistic a view as possible of an apathetic, meek, complacent American populace, it's simply inevitable that some similar form of disorder is in the U.S.'s future as well. As but one example, just consider this extraordinary indicia of pervasive American discontent, from a Gallup finding yesterday.”

That Gallup finding was that only 11 percent of Americans are content with the way things are going in the country.

Greenwald's point, that the surveillance state is actually designed to protect the interests of the ruling class, is supported by Mike Konczal's point, in this July piece:

“From a series of legal codes favoring creditors, a two-tier justice system that ignore abuses in foreclosures and property law, a system of surveillance dedicated to maximum observation on spending, behavior and ultimate collection of those with debt and beyond, there’s been a wide refocusing of the mechanisms of our society towards the crucial obsession of oligarchs: wealth and income defense. Control over money itself is the last component of oligarchical income defense, and it needs to be as contested as much as we contest all the other mechanisms.”

...

As a burgeoning international protest movement takes shape, opposing austerity measures, decrying the wealth gap and rising inequality, and in some cases directly attacking the interests of oligarchs, we're likely to see the surveillance state developed for tracking "terrorists" turned on citizen activists peacefully protesting the actions of their government. And as U.S. elections post-Citizens United will be more and more expensive, look for politicians of both parties to enforce these crackdowns.

Despite growing anger at austerity in other countries, those policies have been embraced by both parties here in the States. Groups like US Uncut have stepped into the fray, pointing out the connection between the tax dodging of banks like Bank of America and other corporations and the slashing of the social safety net for everyone else. The new protest movements are led not only by traditional left groups like labor unions, but a generation of young, wired activists using the Internet for innovative protest and revolutionary activism. 

Anger is growing in the US at a stagnant economy, ongoing policies that favor the rich, and little to no help for anyone else. So far we haven't seen the kind of mass protest that's hit Europe, let alone the revolutions of the Arab Spring, but if things don't get any better, the country should prepare for social unrest. And if that happens, expect more peaceful activists to get caught up in the web of the surveillance state.

Click here to read more.

On a similar note, for what its worth, the ACLU of California has attempting to ascertain from the police when, why, and how they are using mobile phone location data and deploying other surveillance technologies to track the people they are responsible for protecting and serving, the ACLU of California sent requests to more than fifty law enforcement agencies across the state today.  

In addition to the collection of mobile phone location data, the group is asking the same questions about law enforcements’ use of information gathered from social networking sites, book providers, GPS tracking devices, automatic license plate readers, public video surveillance cameras and facial recognition technology.

Police agencies are being asked for information including:

• Statistics on how agencies are obtaining, using, storing and sharing personal information;
• The stated purpose for gathering personal information, guidelines on how long the data is kept, when and how it is deleted, and whether privacy safeguards exist;
• Training curricula, policies or protocol provided to officers to guide them in the use of these powerful new surveillance tools, including the capture of information from social networking sites like Facebook and Twitter;
• Whether police demonstrate probable cause and obtain a warrant to access mobile phone location data and to collect other detailed personal information, or take a dragnet approach that captures data on individuals who are not suspected of wrongdoing;
• The effectiveness of the use of digital surveillance in identifying or arresting suspects.

Based on all the information we have to date, these are particularly pertinent questions, and as citizens, our right to get answers to. In a recent op-ed I wrote on how the Patriot Act has been abused since its inception, there is more than ample reason to believe that not only are these increasing surveillance powers ineffective in "preventing terrorism" (which again, is barely a threat), but in fact, AREN'T BEING USED for that purpose in the first place.

In case there is any doubt, let me list some of what I detailed in my article:

• The FBI admitted in a recent report to the President’s Intelligence Oversight Board that it violated the law at least 800 times on national security letters, going well beyond even the loose safeguards in the original provision. According to the report the FBI “may have violated the law or government policy as many as 3,000 times” between 2003 and 2007, according to the Justice Department Inspector General, while collecting bank, phone and credit card records using NSLs.
• As Adam Sewer of the American Prospect notes: “It's no secret that the FBI's use of NSLs - a surveillance tool that allows the FBI to gather reams of information on Americans from third-party entities (like your bank) without a warrant or without suspecting you of a crime - have resulted in widespread abuses. All that the FBI needs to demand your private information from a third-party entity is an assertion that such information is "relevant" to a national security investigation -- and the NSLs come with an accompanying gag order that's almost impossible to challenge in court.”
• NSLs were used by the Bush administration after the Sept. 11, 2001 attacks to demand that libraries turn over the names of books that people had checked out. In fact, there were at least 545 libraries that received such demands in the year following passage of the Patriot Act alone. 
• The Electronic Frontier Foundation (EFF) uncovered "indications that the FBI may have committed upwards of 40,000 possible intelligence violations in the 9 years since 9/11." It said it could find no records of whether anyone was disciplined for the infractions.
• Under the Bush Administration, the FBI used the Patriot Act to target liberal groups, particularly anti-war, environment, and anti-globalization, during the years between 2001 and 2006 in particular.
• According to a recent report by the ACLU, there have been 111 incidents of illegal domestic political surveillance since 9/11 in 33 states and the District of Columbia. The report shows that law enforcement and federal officials work closely to monitor the political activity of individuals deemed suspicious, an activity common during the Cold War – including protests, religious activities and other rights protected by the first amendment. The report also noted how the FBI monitors peaceful protest groups and in some cases attempted to prevent protest activities. 
• According to a July 2009 report from the Administrative Office of the U.S. Courts, only three of the 763 "sneak-and-peek" requests in fiscal year 2008 involved terrorism cases. Sixty-five percent were drug related.

As I also wrote, and this can be applied to more than just the Patriot Act now, "The Patriot Act was sold as an indispensable weapon in the government’s arsenal to fight and “win” the “War on Terror”. We were assured that the sole purpose of these unprecedented powers granted government were to locate and catch terrorists - not raid the homes of pot dealers and wiretap peace activists. Monitoring political groups and activities deemed “threatening” (i.e. environmentalists, peace activists), expanding the already disastrous and wasteful war on drugs, and spying on journalists isn’t about fighting terrorism, it’s about stifling dissent and consolidating power – at the expense of civil liberties.

How ironic that the very “tool” hailed as our nation’s protector has instead been used to violate the very Constitutional protections we are allegedly defending from “attack” by outside threats. What was promised as a “temporary”, targeted law to keep us safe from terror has morphed into a rewriting of the Bill of Rights.

Indeed...we would do well to stop this runaway surveillance state before its too late to do so....

Is Facial Recognition A Top Privacy Issue of Our Time?

According to privacy stalwarts like the Privacy Rights Clearinghouse (PRC), the ACLU, the Electronic Frontier Foundation and EPIC the answer to this question appears to be a resounding "yes". I speak in particular of an op-ed by Amber Yoo of PRC in today's California Progress Report entitled "Facial Recognition: A Top Privacy Issue of Our Time" that lays out in detail, with accompanying links to other groups work on this topic, just why this burgeoning "security" technology is such a threat.

I have touched on this subject in the past on this blog, particularly when discussing what are called Biometrics. So before I get to some choice clips of Amber's article (and a number of others), let me refresh everyone on the concept of biometric identifiers - like fingerprints, facial, and/or iris scans.  These essentially match an individual’s personal characteristics against an image or database of images. Initially, the system captures a fingerprint, picture, or some other personal characteristic, and transforms it into a small computer file (often called a template). The next time someone interacts with the system, it creates another computer file. 

There are a number of reasons why such technological identifiers should concerns us. So let's be real clear, creating a database with millions of facial scans and thumbprints raises a host of surveillance, tracking and security question - never mind the cost. And as you might expect, such identifiers are being utilized by entities ranging from Facebook to the FBI. In fact, the ACLU of California is currently asking for information about law enforcements’ use of information gathered from facial recognition technology (as well as social networking sites, book providers, GPS tracking devices, automatic license plate readers, public video surveillance cameras).

As for Facebook, consider the ramifications: there's over 600 million members....and each day members upload over 200 million photos - with the network hosting over 90 billion photos total. Each time a photo is "tagged" its facial recognition technology learns more about what that person looks like.

As PC World noted in a recent article on the subject, "Even if you happen to "opt out" of the facial recognition tagging, Facebook's technology can surely use the tagged photos of you (hey, perhaps even the tagged photos of you that you end up un-tagging) to figure out what you look like. Right now Facebook is using this technology to help people tag photos. But once they have an accurate facial recognition database of several hundred million people?"

But, let's get back to the featured article today from the PRC on facial recognition technology:

Facial recognition technology – especially as the technology becomes more sophisticated – may be one of the gravest privacy threats of our time. It has the potential to remove the anonymity Americans expect in crowds and most public places. There are the obvious “chilling effects” it could have on political demonstrations and speech, concerns being monitored by civil liberties advocates like the ACLU, EPIC, and EFF. However, this technology will also very likely be used in greater capacity in the commercial sector to further target consumers for advertising and discriminatory pricing purposes.

Earlier this month, Carnegie Mellon University researchers released a study detailing three experiments that reveal the possibility of identifying people, both online and in the real world, who may otherwise believe they are anonymous. The researchers took photos of people walking on campus and used facial recognition technology and information publicly available online to figure out their name, age, place of birth and, in some cases, even their Social Security number. Many individuals share a tremendous amount of information about themselves online, and the study demonstrates how easy it is to link this online information to a person using facial recognition technology.

...

In his book Niche Envy, Joseph Turow, a professor at the University of Pennsylvania, explains how companies are using increasingly sophisticated market segmentation methods to offer different prices to different people, a practice known as price discrimination. The more detailed the profile a company can build on someone, the more accurately it can estimate how much that person is willing to spend on a product.

Professor Turow focused primarily on online data collection, but as the Carnegie Mellon study illustrates, facial recognition technology makes it possible to connect someone’s offline identity with his or her online identity without obtaining consent. As facial recognition technology advances and the number of consumers using social media continues to increase, it’s not far-fetched to imagine a scenario where a consumer walks into a store and is treated differently or even sees different prices based on the combination of this biometric data and personal information publicly available online. 

A further concern is the unwanted identification of individuals with sensitive circumstances– such as victims of domestic violence, stalking victims, and law enforcement officers.

Click here to read more.

  

This is yet another CLEAR example of technology outpacing regulation, and the need for increased privacy protections for consumers. It will of course take more than just laws to protect us, it will also take knowledge and personal choice...as in the choice NOT to shop or use products sold by companies that are using such facial recognition technologies.

Of course, the use of this technology goes FAR beyond commercial interests. As the Electronic Frontier Foundation's Jennifer Lynch detailed just a couple months ago, the FBI is pursuing the next generation of Biometrics as I write this...with the Patriot Act no doubt serving as the agency's firewall of protection when it violates our civil liberties and privacy.

Lynch writes:

...the Center for Constitutional Rights (CCRFOIA lawsuit that expose the concerted efforts of the FBI and DHS to build a massive database of personal and biometric information. This database, called “Next Generation Identification” (NGI), has been in the works for several years now. However, the documents CCR posted show for the first time how FBI has taken advantage of the DHS Secure Communities program and both DHS and the State Department’s civil biometric data collection programs to build out this $1 billion database.

Unlike some government initiatives, NGI has not been a secret program. The FBI brags about it on its website (describing NGI as “bigger, faster, and better”), and both DHS and FBI have, over the past 10+ years, slowly and carefully laid the groundwork for extensive data sharing and database interoperability through publicly-available privacy impact assessments and other records. However, the fact that NGI is not secret does not make it OK. Currently, the FBI and DHS have separate databases (called IAFIS and IDENT, respectively) that each have the capacity to store an extensive amount of information—including names, addresses, social security numbers, telephone numbers, e-mail addresses, fingerprints, booking photos, unique identifying numbers, gender, race, and date of birth. Within the last few years, DHS and FBI have made their data easily searchable between the agencies. However, both databases remained independent, and were only “unimodal,” meaning they only had one biometric means of identifying someone—usually a fingerprint.

...

So why should we be worried about a program like NGI, which the FBI argues will “reduce terrorist and criminal activities”? Well, the first reason is the sheer size of the database. Both DHS and FBI claim that their current biometrics databases (IDENT and IAFIS, respectively) are the each the “largest biometric database in the world.” IAFIS contains 66 million criminal records and 25 million civil records, while IDENT has over 91 million individual fingerprint records.

Once these records are combined into one database and once that database becomes multimodal, as we discussed in our 2003 white paper on biometrics, there are several additional reasons for concern. Three of the biggest are the expanded linking and tracking capabilities associated with robust and standardized biometrics collection systems and the potential for data compromise.

Already, the National Institute for Standards and Technology, along with other standards setting bodies, has developed standards for the exchange of biometric data. FBI, DHS and DoD’s current fingerprint databases are interoperable, indicating their systems have been designed (or re-designed) to read each others’ data. NGI will most certainly improve on this standardization. While this is good if you want to check to see if someone applying for a visa is a criminal, it has the potential to be very bad for society. Once data is standardized, it becomes much easier to use as a linking identifier, not just in interactions with the government but also across disparate databases and throughout society. This could mean that instead of being asked for your social security number the next time you apply for insurance, see your doctor, or fill out an apartment rental application, you could be asked for your thumbprint or your iris scan.

This is a big problem if your records are ever compromised because you can’t change your biometric information like you can a unique identifying number such as an SSN. And the many recent security breaches show that we can never fully protect against these kinds of data losses.

The third reason for concern is at the heart of much of our work at EFF. Once the collection of biometrics becomes standardized, it becomes much easier to locate and track someone across all aspects of their life. As we said in 2003, “EFF believes that perfect tracking is inimical to a free society. A society in which everyone's actions are tracked is not, in principle, free. It may be a livable society, but would not be our society.”

Click here to read more.

The ACLU put together an excellent Q&A on facial recognition technology, which, in answering why it represents a threat to privacy, states, "One threat is the fact that facial recognition, in combination with wider use of video surveillance, would be likely to grow increasingly invasive over time. Once installed, this kind of a surveillance system rarely remains confined to its original purpose. New ways of using it suggest themselves, the authorities or operators find them to be an irresistible expansion of their power, and citizens' privacy suffers another blow. Ultimately, the threat is that widespread surveillance will change the character, feel, and quality of American life.

Another problem is the threat of abuse. The use of facial recognition in public places like airports depends on widespread video monitoring, an intrusive form of surveillance that can record in graphic detail personal and private behavior. And experience tells us that video monitoring will be misused. Video camera systems are operated by humans, after all, who bring to the job all their existing prejudices and biases. In Great Britain, for example, which has experimented with the widespread installation of closed circuit video cameras in public places, camera operators have been found to focus disproportionately on people of color, and the mostly male operators frequently focus voyeuristically on women. 

While video surveillance by the police isn't as widespread in the U.S., an investigation by the Detroit Free Press (and followup) shows the kind of abuses that can happen. Looking at how a database available to Michigan law enforcement was used, the newspaper found that officers had used it to help their friends or themselves stalk women, threaten motorists, track estranged spouses - even to intimidate political opponents.  The unavoidable truth is that the more people who have access to a database, the more likely that there will be abuse. 

Facial recognition is especially subject to abuse because it can be used in a passive way that doesn't require the knowledge, consent, or participation of the subject. It's possible to put a camera up anywhere and train it on people; modern cameras can easily view faces from over 100 yards away. People act differently when they are being watched, and have the right to know if their movements and identities are being captured. 

And, just to drive this whole post home for you, I found an article on MSNBC yesterday entitled "Post 9/11, surveillance cameras everywhere" (with the subhead, "Security industry boomed for years, but terror is rarely a focus"). 

Here's a few clips from the piece:

Market research firm IMS Research estimates that more than 30 million surveillance cameras have been sold in the United States in the past decade. Video surveillance alone is a $3.2 billion industry, representing about one-third of the overall security market, according to 2007 figures from the Security Industry Association, a trade group. That was the last time they gathered such data, a spokesman said.

...

Although advanced security measures are now commonplace, they are rarely being used to nab would-be terrorists. Instead, security cameras often serve other purposes, such as catching students or workers who are misbehaving, or tracking down common criminals...The increasing prevalence of security cameras, often assisted these days by facial recognition software, have raised thorny privacy questions as Americans find their images captured with increasing regularity. 

...

Privacy advocates warn that we may be too complacent about the fact that our pictures are being taken everywhere from the department store checkout counter to the high school hallway, as well as shared freely on social networks. That data can potentially be used by everyone from marketers to police investigators. “I do think it’s really important when we think about that question of where those data go in the world of social media,” said David Lyon, a professor of surveillance studies at Queen’s University in Canada. 

Click here to read more.

As I have written here NUMEROUS times, what concerns me is what are the side effects of living in a society without privacy. Where are we left when the power of corporate or government interests to monitor everything we do is absolute?

Whether its the knowledge that everything we do on the internet is followed and stored, that we can be wiretapped for no reason and without a warrant or probable cause, that smart grid systems monitor our daily in home habits and actions, that our emails can be intercepted, that our naked bodies must be viewed at airports and stored, that our book purchases can be accessed (particularly if Google gets its way and everything goes electronic), that street corner cameras are watching our every move, and that RFID tags and GPS technology allow for the tracking of clothes, cars, and phones (and the list goes on)...what is certain is privacy itself is on life support in this country...and without privacy there is no freedom. I also fear how such a surveillance society stifles dissent and discourages grassroots political/social activism that challenges government and corporate power...something that we desperately need more of in this country, not less.

CIA Helped NYPD Covertly Spy on Ethnic Communities and Mosques

This is INCREDIBLY disturbing...I'll talk more about it in future posts, but for now, check out Keith Olbermann's expose of this disgrace:

Understanding Behavioral Marketing/Online Tracking

I'd like to alert people to an excellent (though wish it was longer) interview of UC Berkeley privacy expert Chris Hoofnagle in the San Francisco Chronicle. The topic is online privacy and his recent study that found "Despite widening criticism of online tracking, marketers are going to greater lengths than ever to ensure they can monitor online behavior even when consumers take steps to opt out."

As fights over do-not-track rules are taking place both here in California and in DC (both in Congress and the Federal Trade Commission) I thought this to be of particular use for anyone trying to get a better grasp of just what behavioral marketing is all about.

With that, here are some especially pertinent clips from the article/interview:

A noted 2009 paper that Hoofnagle also supervised found that more than half of the most popular websites were employing what's known as flash cookies. Like the standard cookies in Web browsers, these store information that helps identify a unique user, often for the purpose of matching advertising to online behavior.

But flash cookies are more difficult to delete, more efficient at tracking and, the researchers found, often used to back up and "respawn" the standard cookies that users had deleted to avoid monitoring. In other words: Advertisers were deliberately subverting the clearly stated preferences of consumers.

Privacy advocates cried foul, class-action suits ensued and the industry promised to clean up its act.

Whether it actually did was a key question in the study released late last month, which found that while flash cookie use has declined, marketers are using new tools for essentially the same purpose.

Seven of the top 100 sites appeared to be using what's known as HTML5 local storage to back up standard cookies, and two were found to be respawning cookies....Third-party advertisers on the site were still employing the flash cookies, along with another type that takes advantage of the browser's cache, where online data is stored on the computer so it can be delivered faster. This ETag tracking allows advertisers to monitor users, even when they block all cookies and use a private browsing mode.
...

Hoofnagle: "The problem is that, individually, users never have the motivation or technical skills to circumvent the hundreds of companies that are intent upon unique user tracking. They're just outgunned. Most users are using out-of-the-box browsers, so it's very difficult for people to align their settings with their preferences. So the arms race thing raises the question: What is the role for policy?"

...

Q: What's the right policy approach from your point of view?

A: You'll never find a perfect, clean solution. But I'm a fan of data-retention limits. We know from behavioral economics that most people won't turn on do-not-track features, so if you're serious about protecting privacy, if you think there's a value here, you should protect it by default. It would require no user intervention. You would impair the ability of companies and law enforcement to create long-term profiles about people.

...

Q: The industry argues they've given consumers a choice here, allowing them to opt out if they want. Why isn't that enough?

A: Under self-regulatory programs, they allowed people to opt out of targeted advertising if they wanted. But people figured out that what that meant is these companies could still track you, they just couldn't show you online behavioral advertising.

They could still choose to target you in another channel (like direct-mail marketing or telemarketing.) And if you look at all the tracking they do, they can identify you in a fairly trivial way.

Our study also found over 600 third-party hosts of cookies, most of which are not members of any self-regulatory organization (and thus aren't bound to the rules of opt-out programs). They're not even necessarily advertisers, they could be governments. We really don't know who they are. 

Click here for the entire interview.

For information on the Do-Not-Track legislation that was sponsored by Consumer Watchdog and authored by State Senator Alan Lowenthal here in California that unfortunately died in committee check out the page I created on it at the Consumer Federation of California site (as it was a bill we supported).

Another Massive E-Health Record Data "Spill"

A story in the San Jose Mercury News today sounded a few alarm bells regarding just how "safe" our personal data will be in the coming cyber world reality of electronic health records. As many know, the massive transition to e-health records was a key component of both President Obama's health care proposal as well as the stimulus package itself. 

Currently, states across the country, including California, are working to implement such a system, with consumer privacy perhaps the paramount area of dispute.

One of the most important challenges for privacy advocates has been making sure that the transition to electronic medical records includes ironclad data safeguards along with it. We know such a system will save money and improve health care (though how significant these improvements and savings will be is still in question), but what remains contentious - and rightly so - is the intrinsic threat a massive electronic database containing our most personal medical records poses to individual privacy and security.

When it comes to the issue of e-health records certainly one question the consumers should ponder is "Where is my data and who has access to it?" Or perhaps even more importantly, "can my private data be traced back to me personally and sold to others?"

We all consider our healthcare information to be extremely personal and expect the government to protect it from falling into the wrong hands. Granted, regulations alone will never be the end all solution when it comes to privacy in the information age...it must be coupled with public awareness and the pressure that consumer choice can put on industry. 

But as it stands today, there still aren't uniform standards for electronic medical records. Yes, there are some protections in the Health Insurance Portability and Accountability Act of 1996, as well as some in the stimulus bill. But key protections are still absent. 

The prohibition on the sale of medical records is weak and full of loopholes, nor does it apply to vendors like Microsoft or Google. Both companies have agreed to contracts that say they won't release your information, but there is no law mandating that they don't sell the information. If we've learned anything about corporate behavior in recent years, it’s that without ironclad, legal requirements, we shouldn't expect them to behave the way we'd expect from say, a human being.

Similarly, the breach provisions requiring companies to notify patients when electronic medical records are accessed does apply to Google and Microsoft, however, there are safe-harbor provisions that let companies off the hook from the notification requirement if the breach occurred in "good faith."

The federal law on the books only requires that patients are notified when their information was disclosed in the course of treatment but not how it was used. As a result, the patient will not know which hospital personnel looked at the information or for what purpose.

In other words, there's a lot of work still to be done on this issue. Now let's get to the latest breach of very private, personal medical information. The San Jose Mercury News reports:

Until recently, medical files belonging to nearly 300,000 Californians sat unsecured on the Internet for the entire world to see. There were insurance forms, Social Security numbers and doctors' notes. Among the files were summaries that spelled out, in painstaking detail, a trucker's crushed fingers, a maintenance worker's broken ribs and one man's bout with sexual dysfunction.

At a time of mounting computer hacking threats, the incident offers an alarming glimpse at privacy risks as the nation moves steadily into an era in which every American's sensitive medical information will be digitized. 

... 

"When things go wrong, they can really go wrong," says Beth Givens, director of the nonprofit Privacy Rights Clearinghouse, which tracks data breaches. "Even the most well-designed systems are not safe. ... This case is a good example of how the human element is the weakest link."

Southern California Medical-Legal Consultants, which represents doctors and hospitals seeking payment from patients receiving workers' compensation, put the records on a website that it believed only employees could use, owner Joel Hecht says.

...

When mistakes occur, the fallout can be more severe than the typical breach of email addresses or credit card numbers.

In the wrong hands, health records can be used for blackmail and public humiliation. The information can also be used by insurance companies to inflate rates, or by employers to deny job applicants.

Usually when personal data are exposed, it's the result of a network break-in by a hacker or a theft of computer equipment. Sometimes, it can be a simple case of someone mishandling the information. Leaks are more likely the more data are passed around within the health industry's increasingly interconnected networks.

Dozens of companies can be authorized to handle a single person's medical records. The further away from the health care provider the records get, the flimsier the enforcement mechanisms for ensuring the data are protected. 

...

The latest incident is "an eye-opener, and we're going to get eye-opener after eye-opener," says Jim Dempsey, a security and public policy expert at the Center for Democracy & Technology.

As instances of data mishandling become more commonplace, government officials may seek greater control over security policies of companies with access to health care records that aren't currently regulated.

"It should be yet another warning bell for companies: You've got your reputation on the line, and you're also facing enforcement action if you don't pay attention to the security of the data you collect and process," Dempsey says.

For more click here.

In fact, a recent study by Patients Privacy Rights further validated privacy advocates concernsGoogle's scores of a D and F and systems offered by employers and insurers also receiving an F. These are two HUGE providers of what will be the electronic health record "industry" that are still failing us. The group notes:

"The bad news is other companies do not allow patients to control their PHRs. That is a scary thing when you consider that PHRs can store sensitive health information as well as lifestyle habits such as what you eat, how much you drink, and how often you exercise. This information can easily get into the wrong hands, especially if your PHR is offered by an employer or insurer. All PHRs claim to be “patient-centric” and claim that “privacy is important”, but it’s simply not true.

What grades did the PHRs earn?

CapMed’s ICE PHR: C

Google Health: D – Platform F - Partners

Microsoft HealthVault: B – Platform F - Programs

NoMoreClipboard: A

WebMDs: C

PHRs offered by Employers/Insurers: F

...

1) Know that if your PHR is sponsored by your employer or insurer, the odds are VERY GOOD that they have access to all your information. This was quite clear after reviewing a form privacy policy for employer/insurer sponsored PHRs. Sure, not every company is out there to take advantage but personal health information can be used to discriminate, damage reputations and harm opportunities.

2) Every company and product has their own privacy policy. Even if you feel comfortable with a PHRs policy and website, click on a link and leave the site, all bets are off. Any third party that touches your data may not be held to the same standard. This is a key lesson for the Google and Microsoft tools.

...

So what can be done?

1) The public needs to wake up and pay attention. Our personal health information is everywhere and being passed from one company to the next, without our permission or knowledge. If we don’t demand control, we will lose it forever.

2) We need federal laws that make Fair Information Practices the rule for all health information, including PHRs. Data shared for one purpose should be used solely for that purpose unless the patient gives consent for any new use. No single piece of data should be allowed to go to an employer, insurer or other entity without patient permission.

Click here to read the article in its entirety.
 

Pam Dixon of the World Privacy Forum not too long ago broke some of the challenges we face down, stating "Much of the discussion around PHRs has been oriented toward how they benefit consumers, with almost no meaningful or detailed discussion of the privacy risks. As a result, few consumers have the ability to make genuinely informed decisions about these tools. For example, many consumers assume that because a PHR involves health-related information, that special privacy protections must apply. However, there are different varieties of PHRs and PHR companies, some of which do not fall under the federal privacy rules that are usually applied to health information." 

"Many consumers have this deeply held belief that their health information, no matter where it travels, is protected in the same way as when you have a doctor/patient relationship," Dixon said. In reality, consenting to have data transmitted to a non-covered system likely would be viewed as an indication that you had waived your privacy privilege, she added.

Health information stored in commercial PHR systems is also less protected against subpoenas than it otherwise would be, Dixon asserted. Under HIPAA, if someone seeks to subpoena medical records about an individual from a covered entity, the patient has to be informed first. But that protection doesn't apply to PHRs in all instances, she said.

Even more worrisome to Dixon, though, is the potential for protected medical information stored in PHRs to be used for marketing purposes. HIPAA explicitly prohibits such uses, but the terms under which many PHR systems are operated could enable their owners to sell personal health data to marketers, she said. 

People should be aware of such issues when choosing whether to use PHR systems, Dixon said. She added that the operators of PHR systems should be required to clearly disclose whether they are covered under HIPAA and what sort of privacy protections they offer.

As we see the continuing consolidation of, and even the possible monopolization of information technologies, the concern and fear that forces beyond our control have access to EVERYTHING we've nearly ever done will only grow...as will the likelihood that this "power" will be abused...at our expense.

The fact that the health-care and drug-industry lobbies are spending so much effort to weaken privacy standards does not bode well either.

This is an issue I'll be following more on this blog in the coming weeks and months now that California is in the midst of establishing its own e-health record privacy regulations.

Federal Court Judge: Police Can't GPS Track Without Warrant

Before I get to the good news that a Maryland U.S. District Judge recently refused to issue a warrant sought by federal authorities to find a suspect through his cellphone's GPS data, let me provide some backdrop on why this is so important.

Due to technological advancements that allow for nearly ubiquitous tracking of American citizens, combined with the passage (and renewal) of the Patriot Act, the fourth amendment has become an endangered species (if not already gone).

As such, the privacy battleground as related to the tracking of cell phones by police has primarily been in the courts - namely whether probable cause, and a warrant, is necessary for law enforcement to track suspects whereabouts. As one might guess, sadly, the Obama Administration  challenged a recent appellate court ruling over what the proper legal standard should be - as in their should be none.

Perhaps there's good reason for the federal government becoming so adamantly opposed to the fourth amendment: Back in 2009, the Washington Post reported that while serving as a U.S. attorney during the Bush administration, Christopher Christie tracked the whereabouts of citizens through their cell phones without warrants. The ACLU obtained these documents from the Justice Department in an ongoing lawsuit over cell phone tracking. While the documents reveal 79 such cases on or after Sept. 12, 2001, they do not specify how many of the applications were made during Christie's tenure.

Tracking without a warrant disregards an internal U.S. Justice Department recommendation that prosecutors obtain probable cause warrants before gathering location data from cell phones. Of the cases in which probable cause wasn't established, documents showed 19 allowed the most precise tracking available. Those cases occurred after the November 2007 Justice Department recommendation that prosecutors seek warrants.

And if that wasn't enough, there was the 2009 revelation that Sprint received 8 million law enforcement requests for GPS location data in just one year.

What's at stake here is whether it's okay for the government to track the locations of cell phone users without having to demonstrate there's good reason to do so. If we've learned anything post Patriot Act, its that law enforcement and the government do abuse unchecked power, even if only in a small minority of the situations. 

As the ACLU has pointed out, "it's about protecting criminals. It's about protecting innocent people from unjustified violations of their privacy."

Thankfully, this was the argument, generally speaking, made by this federal judge. The Baltimore Sun reports:

Nearly three dozen ACLU affiliates around the country filed public information requests this month with local police agencies seeking statistics on how often GPS data is sought, how it's used and how it's stored. Congress, meanwhile, has held hearings on cellphone technology and privacy, acknowledging that existing law hasn't kept up with issues raised by the proliferation of smartphones and other devices capable of keeping real-time tabs on their owners.

… 

So far courts have come to conflicting conclusions. A federal appeals court overturned a conviction of a Washington man based on a warrantless GPS search, while appellate courts in California and Oregon upheld convictions in their states. The U.S Supreme Court is scheduled to take up the issue in its next term — addressing whether police can place GPS devices on cars to track suspects without obtaining warrants.

...

The American Civil Liberties Union questions how the GPS data is being used by police. The group said last week that police in Michigan sought information for every mobile phone near a planned labor protest, and that Sprint, in just over a year, received 8 million requests from police for global positioning data. The Maryland ACLU chapter is not among those filing information requests. 

...

Federal prosecutors thought it would lead to a quick arrest. But what seemed to authorities a reasonable request was to a judge an intrusion into the suspect's privacy. Gauvey wrote that turning down the government's request "does not frustrate or impede law enforcement's important efforts, but rather places them within the Constitutional and statutory framework which balances citizens' rights of privacy against government's protection of society." The judge wrote, however, that her ruling "does place the precise location information out of the government's casual reach."

...

This is where existing laws have failed to keep pace with technology. Typically, search warrants target documents that already exist, called "stored information," according to the legal brief. In seeking GPS data, prosecutors are seeking documents that have not yet been created — where a person will be in the future.

Click here to read more.

Let's be clear...we're talking about something (i.e. GPS tracking) that has been consistently abused and is becoming more and more common. Documents discovered by the ACLU and Electronic Frontier Foundation, in which they argued government tracking without a probable cause or warrant is a violation of the Constitution's Fourth Amendment, has shown that law enforcement violated individual privacy in states across the country.

The essential argument by privacy advocates, be it the tracking of a cell phone user, or placing a tracking device in a suspect's vehicle, is that, whether you're driving a car or carrying a cell phone you should not be more susceptible to government surveillance. The idea being, no one wants to feel as if a government agent is following you wherever you go - be it a friend's house, a place of worship, or a therapist's office - and certainly innocent Americans shouldn't have to feel that way.

As the article alluded to, this will have to be decided by the Supreme Court - which is itself a frightening thought. What I'll be hoping is that the court will understand the important distinction between short term monitoring that’s not much different from a police tail and ongoing, secret and ubiquitous tracking.

Electronic Frontier Foundation and the ACLU have rightly argued that it's one thing to note someone’s car location and another to keep hourly data on every single stop you make along a specific route for days or months on end. The government has tried to make the case that no such distinction existed.

Let's not forget too...the FBI has been using 'dragnet'-style warrantless cell phone tracking...and this could very likely be the "secret patriot act provision" that has garnered attention, and consternation among some Senators in Congress. You can read more about this in a recent article I wrote about the Patriot Act's renewal, but I think Juan Cole might have said it best, writing:

It should be remembered that it is perfectly possible for the police to make a mistake or act maliciously and to monitor someone who is innocent. The ACLU charges that these practices are increasingly common. If police and other security personnel are allowed to engage in domestic surveillance of this sort without a court warrant, they can start following large numbers of innocent people and learn details of their private lives. Just this year, Tacoma, Wash., police engaged in unconstitutional surveillance of anti-war activists, using an employee at a military base, which is even more troubling. Blanket permission for law enforcement to conduct warrantless GPS tracking of activists could reveal their private peccadilloes, which in turn could be used to blackmail them.

...

Part of what defines public and private is a reasonable citizen’s expectations. You wouldn’t expect all your movements for a month to be public, even if they were in an automobile. It is that understandable expectation of privacy that brings the Fourth Amendment into play. Ginsburg continued, “A reasonable person does not expect anyone to monitor and retain a record of every time he drives his car, including his origin, route, destination, and each place he stops and how long he stays there; rather, he expects each of those movements to remain disconnected and anonymous.” The full court of nine judges upheld the three-judge panel’s decision to throw out the case, which was against nightclub owner Antoine Jones.
 
The federal rulings so far on GPS tracking have been all over the map, so to speak, and that the Fourth Amendment will meaningfully survive the almost cosmic electronic surveillance capabilities of our burgeoning national security state is not at all clear. So far many of our eminent federal judges seem perfectly content with having police officers sneak around in our driveways, with allowing them to attach tracking devices to our private property, and with permitting them then to monitor everywhere we go and everyone we visit, without a warrant, for months at a time. Judge Ginsburg and two colleagues are so far all that stand in the way of this dystopian future becoming our present reality. Unfortunately, because Obama and Holder disagree with Ginsburg, his principled arguments will prevail only if they are permitted to do so by the likes of Antonin Scalia and Clarence Thomas. Welcome to Starship Amerika.

Click here to read more.

I'd also point you to a piece in Computerworld by Darlene Storm. She writes: 

If people can be tagged with a GPS-enabled dart in about a blink, and have no idea their movements on public streets are being tracked, then it seems reasonable that the warrantless surveillance violates the Fourth Amendment. In fact, it sounds a bit like stalking; if permitted to be done without a warrant, then it could easily be done on a large scale and without true suspicion. 

Despite three other courts of appeal ruling that law enforcement does not need a warrant to use GPS tracking on a vehicle, the D.C. appellate court did not agree. Inside GNSS reported that the D.C. court of appeal wrote, "Continuous human surveillance for a week would require all the time and expense of several police officers, while comparable photographic surveillance would require a net of video cameras so dense and so widespread as to catch a person's every movement, plus the manpower to piece the photographs together...A reasonable person does not expect anyone to monitor and retain a record of every time he drives his car, including his origin, route, destination, and each place he stops and how long he stays there."

 

...

...Just because the technology exists does not mean it should be used against the people to invade their privacy as if everyone is a criminal. The next thing you know, the authorities will want warrantless wiretaps to search our email. Oh wait..

Click here to read more.

With all of that said....it looks like a whole lot of this will decided by the Supreme Court...let's just hope that 1 of the 5 right wing pseudo fascist member will stand up for the Constitutional rights they so often claim to be dedicated to protecting...

Are New California PUC Smart Grid Privacy Rules Adequate?

For those that may not know, last year, March 19th to be exact, I spoke before the California Public Utilities Commission regarding the privacy challenges and implications of transitioning to a smart grid electrical system. That's not to say I spoke against the development of such a system, in fact, if implemented correctly, it makes public policy, particularly environmental and economic, sense.

First, briefly: a smart grid system will allow utilities to collect and possibly distribute detailed information about household electricity consumption habits - ice makers will operate only when the washing machine isn't, TVs will shut off when viewers leave the room, air conditioner and heater levels will be operated more efficiently based on time of day and climate. Home gadgets and appliances will be wirelessly connected to the Internet so consumers can access detailed information about their electricity use, and reduce their carbon footprint appropriately.

Soon this technology will be near ubiquitous: Up to three-fourths of the homes in the United States are expected to be placed on the “Smart Grid” in the next decade, and there will be nearly 50 million by 2012. Some foresee it becoming 100 to 1000 times larger than the internet.

But back to the presentation, and then I'll get to the first privacy rules established here in California for this burgeoning electrical system. I happened to be one of three consumer advocates that spoke that day at the CPUC's smart grid workshop...with the focus of that seminar purely on privacy. I suspect I was asked in part due to my op-ed in the California Progress Report, as well as my position at the Consumer Federation of California, and my occasional blog posts here on the topic.

To watch the presentation click here and scroll down to my name - Zack Kaldveer...and click again. The purpose of my presentation, as I will detail here today, was to breakdown ALL the different ways a smart grid system could threaten the privacy of consumers, and the real world damage such privacy violations could cause if the system wasn't developed in a way that put privacy, and consumer control, first.

As I said at the time, "But the paradox of a smart grid system is that what will ostensibly make it an effective tool in reducing energy usage and improving our electric grid – our information - is precisely what makes it a threat to privacy: our information...

The sheer volume of data provided by Smart Grid technologies will make it a prospective goldmine for numerous parties other than the utilities themselves, for reasons other than energy efficiency, and used for purposes that do not benefit the consumer: advertisers and marketers will seek to create and utilize increasingly detailed behavioral profiles, law enforcement and the government will seek to monitor our homes, and criminals will seek to steal identities and rob homes.

As such, without proper safeguards and ironclad rules in place, a myriad of new privacy threats could eventually find their way into every home in America. 

Activities that might be revealed through analysis of home appliance use include personal sleep and work habits, cooking and eating schedules, the presence of certain medical equipment and other specialized devices, presence or absence of persons in the home, and activities that might seem to signal illegal behavior. 

Personal privacy issues routinely arise when data collected is harmless in isolation, but becomes a threat when combined with other data, or examined by a third party for patterns. In other words, what are the potential “unintended consequences” of such an electrical system? And more importantly, what must we do to ensure that those unintended consequences are never realized? 

Such interest in our private data by third parties begs some important questions: How much information should we give up to the grid? Should it be up to the customer to decide? Who stores all that information and for what reasons? How will this information be managed and how long will it be stored? Who will come asking for that information, for what purposes and under what rules? And will there be proper and enforceable accountability for those that abuse our data?

So, with that general description of the system itself, and the related privacy concerns, now let's get to the unanimous vote by the CPUC to adopt the world’s first comprehensive set of rules to ensure that consumers can access the detailed energy usage data gathered by their smart meter — while also protecting the privacy and security of their data. At least...in theory....

The decision applies to the three large investor-owned utilities which serve 80% of Californians with electricity (Pacific Gas & Electric, San Diego Gas & Electric and Southern California Edison). At last count, these three utilities had installed 8 million smart meters. By the end of 2012 they will deploy the final 3 million. 

As detailed by the San Francisco Business Times, "The CPUC is requiring utilities to regularly conduct independent security audits of their wireless meters and to restrict the access of third parties, such as energy-efficiency consultants, to customers' personal details. In addition to the privacy and security rules, the commission is requiring utilities to provide pricing, usage, and cost data to customers online and update the data at least on a daily basis. Each day's usage data, along with applicable price and cost details, must be available by the next day...the standards are consistent with privacy and security principles adopted by California's Senate Bill 1476, which former Gov. Arnold Schwarzenegger signed into law last September, and by the Department of Homeland Security

.....

Although hackers and spammers have so far spared digital smart meters and electrical grids from their cyber intrusions, the massive national rollout of devices and grid upgrades planned for this decade cyber thugs.

"In all systems of this type, the install base needs to reach a critical mass before attackers start looking at breaking these things," Jun said.

In June, the Department of Energy announced that a $4.5 billion stimulus program to ramp up smart grid technology projects, matched by $5.5 billion from the private sector, has already led to the installation of 5 million of the nation's meters. The DOE requires that eligible projects include security provisions to protect against hacking, but it doesn't detail what those measures should look like.

"We are putting devices in homes where — if the right investments in security aren't made now — it is going to be impossible to retrofit them," Jun said. "For an industry that is so new and building infrastructure to last 50 years, one of our major challenges is helping people think ahead." 

More specifically in relation to the privacy component of the decision, it notes, "Consumers will be able to authorize third parties to receive their backhauled smart meter data data directly from the utility (as opposed to data that comes directly from the meter), to support services such as energy efficiency, demand response, energy advice, and more. The three major utilities will submit to the CPUC applications with specific plans, including which standards they will use — probably the Open Automated Data Exchange (OpenADE) standard in final development by NIST’s Smart Grid Interoperability Panel and the North American Energy Standards Board. The utilities, however, will bear no new liability for the actions of third parties which acquire information via this [mechanism].”

Furthermore, to protect consumer privacy and data security, the CPUC is exercising jurisdiction over third parties who receive data (via the backhaul mechanism) in the course of providing services to utilities, or when authorized by consumers. However, the CPUC is not exercising jurisdiction over third parties who receive energy usage data directly from a device installed at residence or business that receives data via the HAN interface.

In this decision the CPUC relied mainly on existing privacy law, using the Fair Information Practice Principles which the U.S. Department of Homeland Security developed as its privacy framework. To clarify the application of these principles, the CPUC decision includes an appendix with details of its privacy rules.
 
Here are the FIP principles, all of which are utilized by the CPUC:
1.    Transparency
2.    Individual participation
3.    Purpose specification
4.    Data minimization
5.    Use limitation
6.    Data quality and integrity
7.    Security
8.    Accountability and auditing

Now, there does appear to be a lot of good things about this ruling...and certainly, privacy has been seriously taken into account. But all it takes is one loophole to release the floodgate of privacy violations and loss of consumer control.

Essentially, there are two general concerns (so far) that I have - namely third party jurisdiction and the lack of adequate enforcement mechanisms (to serve as a proper deterrent).

First and foremost, and I have spoken about third parties A LOT on this blog, my concern is the line about the CPUC not using, or suggesting they don't even have, jurisdiction to enforce the same kind of privacy standards that the utilities must abide by as those that will be applied to third parties. Here’s the key passage of their decision:

“The utilities, however, will bear no new liability for the actions of third parties which acquire information via this [mechanism]"

and 

"it will not exercise jurisdiction over third parties who receive energy usage data directly from a device installed at residence or business..."

On a similar note, after talking with our staff attorney who has been deeply involved in this debate, there also  could be confusion when it comes to definitions of just which devices fall under which category, and which provide maximum privacy protection and which don't. And because of these definitional challenges, third parties will be able to circumvent the registration process by asserting that their devices are “unlocked.” I think that this challenge can be remedied if all parties who sought Smart Grid data would fall under the Commission’s jurisdiction.

The other concern I have, is what appears to be weak penalties  for those that violate basic consumer privacy rules. As I understand it, the only real penalty is that they can no longer ask for data…not exactly a powerful deterrent. AS our attorney wrote to the CPUC, “CFC stated that the proposed rules should be modified to reflect a balance in responsibility between customers and utilities/third parties. When it comes to consumer authorized access to energy data, consumers are left to regulate themselves with what CDT states “a heightened responsibility [for consumers] to understand the implications of this disclosure.” Moreover, there is no penalty or enforcement if utilities or third parties violate these privacy rules. CFC supports the Commission’s adoption of requirements that promote customer education, awareness, and empowerment. However, customer empowerment is only one piece of the puzzle when it comes to effective consumer protection. Proper accountability that includes penalties for violations by utilities and third parties is the other piece."

Now, let's say a third party is given access to this data unknowingly or unwittingly by the consumer...what  are some potential, specific examples of the kinds of “unintended consequences” that might take place? Well, here's the list I gave personally:

• Travel agencies might start sending you brochures right when your annual family vacation approaches.

• Financial institutions making home mortgage loans might also be interested in their customers’ energy usage records to verify whether the customers are actually living in those houses.

• Law enforcement officials might use our information against us. Consider the predictable desire of police to locate in-home marijuana growers by monitoring household power usage? What about increasingly intrusive surveillance of proclaimed suspects homes?

• Lawyers might seek to subpoena your data in a divorce trial, "Have you ever left your child home alone? If so, how often, and for how long?

• Insurance companies, always seeking to maximize profits by denying coverage or jacking up premiums, might start developing connections between energy use patterns – like eating late at night - and unhealthy tendencies.

• Soon RFID tagged labels – read by smart meters – will be found on more and more of the food and prescription drugs that fill our refrigerators and cabinets. Could our health insurance go up because we eat too much unhealthy food? Might we start receiving mailers trying to sell us new prescription drugs that their detailed behavioral profile has led them to conclude we need?

• Hackers and criminals might seek to falsify power usage, pass on their charges to a neighbor, take down the grid entirely, disconnect others, and plan burglaries with an unprecedented degree of accuracy.

• Some consumers are already getting statements that compare their use to their neighbors. Could we see a system develop in which some are penalized for more “wasteful” usage? What if the comparisons aren't fair? Will details such as the number of occupants be properly taken into account?

• Landlords might be interested in know more about what's happening inside their properties.

• If recent revelations regarding warrantless wiretapping, Patriot Act abuses and increasingly intrusive surveillance techniques are an indicator, we should also expect government agencies to come seeking our data.

As I also said that day, "such privacy implications strike at the heart of the Fourth Amendment, the California Constitution, and a core American value: our right to keep private what goes on in our homes, and the inherent freedom that that right provides us. The challenge that now stands before us is how to both protect consumer privacy while simultaneously empowering customers with the ability to access their data in near real time and potentially share it with entities other than the utility.

It is paramount then that our state’s transition to a smart grid system addresses the potential privacy pitfalls while we are in the early stages of its implementation; because once that genie is out of the bottle it’s difficult to put him back in.

A few principles we should keep in mind as we develop a regulatory framework will be consumer control, informed consent, transparency, security and accountability - including strict limits on the amount of data collected, its use, and the length of time it’s stored.

Such privacy safeguards will increase, not decrease, the long-term viability of, and consumer confidence in, the system itself. The only real conflict I foresee in implementing such a system is between those that want to protect their personal data versus those that seek to access and profit off it; as well as the expected public policy rush to get the system up and running before it’s truly ready.

The endless accumulation of our personal data – combined with the outlandish profits being made off it and growing government demand for it – represents a direct assault on our right to privacy. We would do well to contemplate the steady erosion of this right and its long-term implications.

Corporations, by definition, care about profit, not reducing energy usage, and certainly not protecting privacy, just as governments, particularly federal, care more about access and control.

Rapid technological advancement - without the requisite regulatory safeguards – will only add to the increasing disintegration of privacy rights in this country - something the Smart Grid could come to epitomize if we allow ourselves to be seduced by arguments that claim we have no time to spare or to just “trust” those with inherent conflicts of interest."

At this point, its too early to say whether my warnings have been properly heeded...certainly the jurisdiction issue suggests they have fallen short - so far.  But nothing is in stone yet...so I'll keep you posted.

Locational Tracking and the "Secret Patriot Act" Provision

Just last week, and before that in a recent op-ed I wrote on the Patriot Act, I've mentioned what some call "Secret Patriot Act" provisions and whether they relate to the government using cellular data to track Americans as they move around the U.S.

Here's the key point: the government has been claiming information regarding its interpretations and uses of the Patriot Act - particularly in relation to surveillance of American citizens - is classified. What tipped people like myself off that something was especially fishy were Senators Ron Wyden and Mark Udall sounding the alarm bells consistently and passionately for months now regarding this "secret legal interpretation" of the Patriot Act  - one they claim is so broad that it gives the government massive domestic surveillance powers.

Wyden recently even said, "When the American people find out how their government has secretly interpreted the Patriot Act they will be stunned and they will be angry." And, as a member of the Senate Intelligence Committee Wyden is in a position to know, as he receives classified briefings from the executive branch. 

Their requests for transparency has of course been met with obfuscation and denial from the Administration and Justice Department.

The good news is that Senator Wyden doesn't appear ready to take "no" for an answer, and is using the re-authorization of the Foreign Intelligence Surveillance Act (FISA) - adopted in 2008 essentially legalizing President George W. Bush’s “warrantless wiretapping” program - as the vehicle to get answers.

This FISA 2.0 law - abhorred by privacy advocates and civil libertarians - is set to expire by the end of next year, and is currently being heard in the Senate's Select Committee on Intelligence, of which Wyden is a member.

Of course, as has become typical when it comes to issues like privacy and surveillance, this proposed 2 1/2-year extension was inserted without any public notice into the Intelligence Authorization Act for the fiscal year that begins Oct. 1.  

As AP reported, "The move was unusual because it took place a full year and a half before the law's expiration date. Ordinarily, a proposed extension isn't brought up until closer to the expiration date of the law."

The bad news is that the intelligence bill was approved Monday by the Committee on Intelligence, would extend the 2008 changes until 2015. As the LA Times noted, "Those changes greatly expanded the government’s surveillance authorities. The targets must be foreigners out of the country, but their conversations with Americans are fair game. Senator vows to block surveillance bill over privacy concerns."

Also unfortunately, a measure by Sens. Ron Wyden and Mark Udall that would have forced the U.S. intelligence chief, and by extension the entire intelligence community, to admit that they went too far in their Patriot Act interpretations, was defeated.  

Essentially, Wyden and Udall asked that their colleagues include a measure compelling the Director of National Intelligence and the Attorney General to produce a “detailed assessment of the problems posed by the reliance of government agencies” on “interpretations of domestic surveillance authorities that are inconsistent with the understanding of such authorities by the public.” 

Specifically, Attorney General Eric Holder and Director of National Intelligence James Clapper would have to produce “a plan for addressing such problems” with secret legal interpretations regarding the Foreign Intelligence Surveillance Act (FISA) and the Patriot Act.

The Committee also rejected an amendment by Wyden and Udall that would have required the Justice Department to estimate how many Americans have been eavesdropped on, in violation of another surveillance law, the FISA Amendments Act of 2008. That amendment was voted down, 7-8.

Now, while we can't be sure what these senators are referring to, the evidence suggests, and some assert, that the current administration is using Section 215 of the Patriot Act - a provision that gives the government access to "business records" - as the legal basis for the large-scale collection of cell phone location records. 

And remember, mobile telephone users have LOTS of reasons to be concerned about this too. Consider:

• In just a 13-month period, Sprint received over 8 million demands for location information;  
• Michigan police sought information about every mobile phone near the site of a planned labor protest;
• This spring, researchers revealed that iPhones were collecting and storing location information;
• Just last week, the general counsel of the National Security Agency suggested to members of Congress that the NSA might have the authority to collect the location information of American citizens inside the U.S.

Watch Wyden here!

Now, in response to this string of setbacks and stonewalling, Senator Wyden is vowing to block the surveillance bill altogether! The Los Angeles Times has more:

Sen. Ron Wyden (D-Ore.) will seek to block passage of an intelligence bill that extends the government’s eavesdropping authorities because the intelligence community won’t say how many Americans are being monitored... 

... 

"Congress passed the FISA Amendments Act in 2008 in an effort to give the government new authorities to conduct surveillance of foreigners outside the United States,” Wyden said in a statement. “The bill contained an expiration date of December 2012, and the purpose of this expiration date was to force members of Congress to come back in a few years and examine whether these new authorities had been interpreted and implemented as intended,” Wyden wrote. “I believe that Congress has not yet adequately examined this issue, and that there are important questions that need to be answered before the FISA

After first opposing them, then-Sen. Obama voted for the 2008 FISA changes, which gave legal immunity to telecom companies that cooperated with Bush’s spying program. He said he became convinced the capabilities were needed to hunt for terrorists.

...

Wyden also wants to know to what extent the government is tracking the location of Americans using data from their cellphones. Mobile devices are regularly telling their networks where they are, even when the use is not making a call, and that data is regularly used by law enforcement to track criminal suspects and fugitives. Whether intelligence agencies are doing that domestically is an open question.

...

“During a July 2011 committee hearing, the general counsel of the National Security Agency acknowledged that certain legal pleadings by the executive branch and court opinions from the Foreign Intelligence Surveillance Court regarding the Patriot Act are classified,” Wyden and Udall said in dissent included in the Senate committee report on the bill. “We have had the opportunity to review these pleadings and rulings, and we believe that most members of the American public would be very surprised to learn how federal surveillance law is being interpreted in secret.”

...

Wyden said he is placing a “hold” on the bill, a parliamentary maneuver that will make it much more difficult to pass. “I regret that the amendment that Sen. Udall of Colorado and I offered was not adopted, but I obviously plan to keep trying to get more information about the effects of this law,” Wyden said. “I hope that I will find out that no law-abiding Americans, or at least very few, have had their communications reviewed by government agencies as a result of this law, but I believe that I have a responsibility to get concrete facts rather than just hope that this is not the case.  And I believe that it would be not be responsible for the Senate to pass a multi-year extension of the FISA Amendments Act until I and others who have concerns have had our questions answered.” 

Click here to read more. 

While its heartening, and frankly inspiring, to see an elected official stand so strongly in favor of the bill of rights at a time when they are viewed with such disdain by governmental and corporate power, I'm perhaps more disheartened by the fact that the Wyden/Udall Amendments can't even pass out of a Democratic controlled Committee. As for Obama's flip flopping and betrayals on privacy and civil liberties related issues, this is now expected.

It should be noted however that Senator Wyden is by no means on his own in the locational tracking and transparency fight. Just today the ACLU of California demanded information on how police are using surveillance technology to track people. The group has asked for public records from more than 50 police agencies across state focusing on mobile phone location data, GPS tracking, information gathered from social networking sites.

From the groups release: "Demanding to know when, why, and how police are using mobile phone location data and deploying other surveillance technologies to track the people they are responsible for protecting and serving, the ACLU of California sent requests to more than fifty law enforcement agencies across the state today.  Today’s requests are part of the ACLU’s Demand your dotRights Campaign, designed to make sure that as technology advances, our privacy rights are not left behind. The Public Request Act inquiries are being filed in coordination with 33 American Civil Liberties Union affiliates across the nation.

“The public has a right to know how and under what circumstances their personal information is being accessed by the government," said Peter Bibring, staff attorney with the ACLU of California.  "A detailed history of someone's movements – or the email and photographs stored in their mobile device - is extremely personal and exactly the kind of private information that the Fourth Amendment was written to protect." 

In addition to the collection of mobile phone location data, the ACLU of California is asking the same questions about law enforcements’ use of information gathered from social networking sites, book providers, GPS tracking devices, automatic license plate readers, public video surveillance cameras and facial recognition technology.

Police agencies are being asked for information including:

• Statistics on how agencies are obtaining, using, storing and sharing personal information;
• The stated purpose for gathering personal information, guidelines on how long the data is kept, when and how it is deleted, and whether privacy safeguards exist;
• Training curricula, policies or protocol provided to officers to guide them in the use of these powerful new surveillance tools, including the capture of information from social networking sites like Facebook and Twitter;
• Whether police demonstrate probable cause and obtain a warrant to access mobile phone location data and to collect other detailed personal information, or take a dragnet approach that captures data on individuals who are not suspected of wrongdoing;
• The effectiveness of the use of digital surveillance in identifying or arresting suspects.

“Unless we require transparency on the part of police agencies, powerful new methods of surveillance will become powerful new methods of invading our privacy,” said ACLU of California  attorney Linda Lye.

With Congress considering new legislation to better safeguard location information and the U.S. Supreme Court poised to hear a case about the privacy of location data in the context of GPS tracking devices, it is essential for the American public to have a clear picture about when, why, and how law enforcement are obtaining sensitive location information.

“It’s important to understand whether police agencies are using new surveillance technologies in ways that serve legitimate law enforcement goals and actually make us safer,” said ACLU of California attorney David Blair Loy."