GPS-based car insurance faces security concerns

As I have written about here in the past, a broad coalition of organizations, from consumer rights groups like the Consumer Federation of California (us) and Consumer Watchdog, to privacy rights groups like the ACLU, Privacy Rights Clearinghouse, and the Electronic Frontier Foundation, are opposed to Assembly Bill 2800 (Huffman).

This so called "Pay as You Go" law would requires insurance companies to base the auto insurance rates charged in California primarily on a motorist’s 1) driving safety record, 2) annual miles driven and 3) years of driving experience.

There are a number of reasons why our coalition opposes this kind of policy-making - most notably related to privacy and economic justice. Before I get to the privacy aspects, here's a bit more on why this a bad bill.

AB 2800 would create an unfair system of insurance discrimination in which similarly situated policy holders would pay different prices. Under AB 2800, an insured who participates in an insurance company’s optional “green” plan would pay a lower insurance rate than a similarly situated policy holder who drove an identical number of miles but who did not participate in the same insurance company’s “green” plan. If every other factor about the policy holders is the same, the fact that one is not a participant in a program would unfairly result in a higher premium under AB 2800.

Now to the privacy aspect of the bill, and how it relates to the article I'm going to post today. AB 2800 would allow insurance companies to require drivers to use technological devices in their cars, or pay a higher rate if they refuse. The mileage program is nominally “voluntary,” but its permissive language would result in mandatory GPS monitoring, since a driver would be forced to pay more if he or she did not participate. There is no language in the bill limiting the information that an insurer may collect from a GPS device.

This raises significant privacy concerns regarding collection of data on consumers’ driving habits, destinations and other information that is not germane to the objective of verifying the total miles driven.

Now I point you to exhibit A - an article in Computing, a UK web magazine.

Angelica Mari reports:

The adoption of GPS technology for underwriting processes in the automotive industry may present potential security concerns. While wrong use of data could have an adverse effect in ways that might not have been foreseen, such as affecting house prices, the same ambiguity can also be found in the automobile insurance space.

...

But despite its apparent attractions, management of the technology represents a challenge to businesses, said Martha Bennett, research director for financial services at analyst Datamonitor. "The question is, how do insurers ‘draw the line’ when the driver switches off the system – do they switch it off legitimately because they are on their lunch hour, or do they do it deliberately because they are about to commit a crime?”

...

In such schemes, GPS-based systems are used to assess premiums to be paid by insurance companies depending on whether cars run on accident-prone areas, but there is also the potential risk of privacy invasion.

“Other points of debate include the right for police or government agencies to ask for such data and how long the data should be kept if they ask for GPS records from insurer, because there is reason to believe a vehicle has been used for a crime,” said Bennett.

I suspect this debate over using GTS monitoring to determine insurance rates is in its early stages, and apparently the UK, as with California, are examples of what's to come. What's interesting about these two, is the UK is notoriously bad on privacy rights issues and California is notoriously good. We'll see how this issue plays out in each, and how that might influence future debate in other states and nations.

China, the Surveillance State, and Us

As I've been watching the Olympics, and learning more about the incredibly invasive surveillance methods utilized by China's government, I got to thinking about a couple things. One, in what way are American and other nation's corporations facilitating, supplying, or enhancing these state of the art surveillance and monitoring technologies? And two, what role might these technologies - that can monitor, track, and censor nearly everyone at all times - play in our country someday?

Once I started digging, I was increasingly dismayed by what I found. As the answer to both questions were not what I wanted to find. As in, yes, American corporations are profiting off an assortment of human rights eviscerating and privacy violating technologies being utilized in China. And yes, our government, and corporations, most certainly are using China as a testing ground for which surveillance systems oppress the public and stifle dissent most effectively.

Rather than continue to pontificate on these enormously important issues, let me direct you to two outstanding articles by experts that know far more than I.

First, here's a few clips from Naomi Klein's recent expose of how China is using the Olympics - not to create a more open society - but rather to create a more oppressive one.

Klein writes:

Much of the Chinese government’s lavish spending on cameras and other surveillance gear has taken place under the banner of “Olympic Security.” But how much is really needed to secure a sporting event? The price tag has been put at a staggering $12-billion — to put that in perspective, Salt Lake City, which hosted the Winter Olympics just five months after September 11, spent $315 million to secure the games. Athens spent around $1.5-billion in 2004. Many human rights groups have pointed out that China’s security upgrade is reaching far beyond Beijing: there are now 660 designated “safe cities” across the country, municipalities that have been singled out to receive new surveillance cameras and other spy gear. And of course all the equipment purchased in the name of Olympics safety — iris scanners, “anti-riot robots” and facial recognition software — will stay in China after the games are long gone, free to be directed at striking workers and rural protesters.

...

There is a bitter irony here. When Beijing was awarded the games seven years ago, the theory was that international scrutiny would force China’s government to grant more rights and freedom to its people. Instead, the Olympics have opened up a backdoor for the regime to massively upgrade its systems of population control and repression. And remember when Western companies used to claim that by doing business in China, they were actually spreading freedom and democracy? We are now seeing the reverse: investment in surveillance and censorship gear is helping Beijing to actively repress a new generation of activists before it has the chance to network into a mass movement.

...

It’s easy to see the dangers of a high tech surveillance state in far off China, since the consequences for people like Jun are so severe. It’s harder to see the dangers when these same technologies creep into every day life closer to home-networked cameras on U.S. city streets, “fast lane” biometric cards at airports, dragnet surveillance of email and phone calls. But for the global homeland security sector, China is more than a market; it is also a showroom. In Beijing, where state power is absolute and civil liberties non-existent, American-made surveillance technologies can be taken to absolute limits.

Click here to read the rest of Klein's rather disturbing article. But unfortunately, her article only scratched the surface of the kinds of specific new technologies China is using, and where they specifically are coming from.

For that, I found a great piece by Dmitri Vitaliev, who works extensively in the human rights and independent media, entitled Corporate Complicity With the Great Firewall. As you will notice, it's not a stretch at all to believe that these very same technologies would be welcomed additions to our own surveillance state here in America.

Vitaliev writes:

A recent (non-intrusive) scan through the website of the Chinese Ministry of Public Security revealed a number of documents listing an inventory of various security technologies. One spreadsheet details software and hardware implemented for network surveillance, packet scanning and user detection. A closer inspection reveals that the Chinese internet infrastructure employs a huge array of security products, procured from companies all around the world.

...

Security China 2000, the largest national security exhibition, attended by the world’s most renowned IT corporations, marked a beginning of Chinese endeavours to create the world’s most sophisticated surveillance infrastructure. It was sponsored by the Chinese Public Security Bureau, the ministry in charge of policing the internet. The meeting was attended by US-based Lucent, Sun Microsystems and Cisco, European wireless giants Nokia and Ericsson, and Canada’s Nortel Networks, among many others. The main event was China’s Golden Shield Project - an ambitious plan to link China’s national and internet surveillance networks, public record databases, CCTV cameras, speech and face recognition databases, smart cards, credit records and a myriad of regional and national ministries. Their mission was to make the network “see, hear and think” in the continuing effort to solidify state control.

...

An enthusiastic business partner of the Chinese state apparatus has been Cisco. Notorious for its several appearances before the US House of Representatives to explain their role in supplying virtually the entire hardware on which the Golden Shield Project operates, as well as multiple systems to assist Chinese ministries responsible for catching political and social dissidents and censoring the internet. In 1997, Cisco won the contract to supply internet “firewall boxes” and, by 2006, they supplied 60% of the Chinese market for routers, switches and other sophisticated networking gear. Its estimated annual revenue from China is $500m.

In 2003, Cisco’s “Policenet” software was rolled out as the backbone of the Chinese state security system. This software, in conjunction with Intel’s fingerprint technology, is compatible with the Chinese surveillance systems and allows a policeman stopping a person on the street to scan that person’s ID card and access instantly the individual’s past political and social behaviour, family history and recent internet activity.

...

It is futile to argue whether western corporations are directly responsible for the uses to which China puts their technologies. Following basic free-trade principles, products are most likely sold “as is” to (rather than customised for) the Chinese government or third-party resellers. However, just as in the arms trade, these practices have led to the creation of a hostile digital environment, inhabited by Da Ge (pinyin for Big Brother). Whenever we pause to discuss or protest China’s decision to filter websites or jail Yahoo email account holders, we must bear in mind that the technology that has made this possible was built in our own backyard.

So, as we revel in the beauty, passion, and grace displayed by Olympic athletes, as well as the joy, respect, and adulation of people around the world for this event, we should also remember that just outside of our television screen's view, Big Brother is watching...and we're supplying him with the tools to do it...as big business and the US government contemplates how we can become just as "all seeing" as China.

Measure seeks restrictions on laptop searches

I want to follow up on yesterday's post regarding the government's recent assertion that they have the right to confiscate and then access anyone's laptop for any reason they deem necessary. It appears the first legislative attempt to restrict such searches is underway in Congress.

HS Today Reports:

In response to growing concerns about the search and seizure of laptops and other electronic devices by the US Department of Homeland Security (DHS) at border checkpoints, a New York congressman has introduced a bill to require the
department to establish a "reasonable suspicion" of a crime before examining electronic data, the bill's sponsor said in an editorial Friday.

...

The legislation also would require government agents to search any electronic devices in private. Once a laptop or any electronic data were seized, DHS would have to protect the data, to keep the data for only a limited time, to restrict the sharing of the data, and to respect a traveler's right to the return of electronic devices or data.

...

Critics like the American Civil Liberties Union have objected to a number of recent limitations on the Fourth Amendment to the US Constitution, which protects US citizens from unreasonable search and seizure, including the use of data under the reauthorization of the Federal Intelligence Surveillance Act (FISA) (PL 110-261), signed by President Bush on July 10.

Click here to read more.

Department of Homeland Security Wants Your Laptop Info

Michael Chertoff - our failed Homeland Security chief - has made a rather extraordinary claim this week that should have all American's concerned. Chertoff actually said that border agents have the right, for any reason they deem appropriate, to look into or even seize your laptop computer and all that it contains within. But that's not all, he also argued against creating a legal standard for searching Americans' electronics since it would "just lead to too much litigation."

So for those following this ominous turn of events, for ANY reason, YOUR laptop and everything you have stored on it, can be taken from you by the government...the same government responsible for Abu Graihb, Rendition, Guantanamo, warrantless wiretapping, military tribunals, the Patriot Act, and the evisceration of Habeus Corpus.

Senator Russ Feingold, the ONLY US Senator to vote against the Patriot Act, and the most consistent and committed privacy champion we have in Congress today, has already come out with a blistering critique of Chertoff's assertions.

Wired Magazine Reports:

Democratic Sen. Russ Feingold opposes border agents searching through Americans' laptops without cause, and he doesn't like how Homeland Security Chief Michael Chertoff articulated the government's current policy...

...

Feingold, an outspoken civil libertarian -- the only senator to vote against the Patriot Act -- begs to differ.

Secretary Chertoff's description of the newly published DHS policy on laptop searches was not just misleading – it was flat-out wrong. In an interview with Wired.com, the Secretary stated that "[w]e only do [laptop searches] when we put you into secondary [screening] and we only put you into secondary [screening] ... when there is a reason to suspect something."

But the actual policy that DHS published says the exact opposite. It does not even mention secondary screening, let alone limit laptop searches to those cases, and it expressly states that Americans' laptops may be searched "absent individualized suspicion."

Secretary Chertoff's blatant mischaracterization of the DHS policy contradicts his claim to be engaging in greater "openness and transparency" on this important issue. His statements make it clearer than ever that as we work to protect our national security, Congress must also act to protect law-abiding Americans against highly intrusive searches.

The bad news is that the 9th U.S. Circuit Court of Appeals, considered the most liberal of the appeals circuit, ruled in May that border agents did not need any reason to look through a laptop, reversing a lower court that decided that laptops were closer to extensions of ourselves than the modern analogue of a suitcase.

I also came across a doctor's post on this recent pronouncement by the DHS, in particular how it might conflict with HIPAA (the Health Insurance Portability and Accountability Act) - the law that governs the privacy of your medical information.

Perhaps Health and Human Services (HHS) can take on DHS in defense of our medical privacy?

Here's a few clips from that post:

It (HIPAA) is very, very detailed, and requires quite a bit from your doctor. You've signed a form at the office of every provider you've visited that notifies you of your privacy rights. I cannot discuss your care in a hospital elevator. I can't send you an email regarding your health without making it very clear that any information in the email cannot be considered secure. I cannot disclose your health information to anyone else except under very specific and limited circumstances. HIPAA has radically changed the way we do things with health information (sometimes for the better, sometimes not).

Moving on to Homeland Security---DHS agents may, for any reason or none at all, seize my laptop and demand any security or encryption codes. My laptop not infrequently contains information covered by HIPAA (known as PHI, or Protected Health Information). Because of that, my laptop is secured via HIPAA-compliant security measures. Under the new DHS guidelines, I can be required to hand over my laptop and help officers access the information without any suspicion of wrong-doing. We have a little problem here...

HIPAA is often wrongly invoked. For instance, when I call another doctor's office to get information on a shared patient, the secretary will sometimes ask me for a HIPAA form signed by the patient before they give me the information. This is an incorrect application of HIPAA. The law is not designed to impede the treatment of patients.

...

Now, running my office and taking care of patients is about as far as my knowledge goes. What happens when an armed government agent asks me to turn over protected health information? HIPAA has a few clauses that are ambiguous to me as a doctor, specifically "Public Interest and Benefit Activities". The big get-out-of-jail free card is this one:

Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).

...

It's time for HHS and DHS to get together and make a few clarifications for us, before we all have to further enrich our lawyers. Better yet, perhaps the ACLU could get together with other groups of converging interests and fight DHS on this one.

Clearly this is an issue that should be of utmost importance to privacy advocates, as it represents a gross and dangerous infringement on our most fundamental of constitutional protections. In other words, this is a MUST WIN battle in the long term war over what constitutes privacy in America today.

Click here to read more...

Metal theft bill amended to protect privacy

Here's a piece of legislation in California that had slipped under my radar. Thankfully, its because of improvements related to the privacy protection of consumers that it caught my eye. The bill is designed to crack down on metal theft - which is a widespread problem according to bill supporters - and recently cleared a key Senate committee after the author amended the measure to increase privacy protection for scrap sellers.

Now, I'm the last person that would ever claim to be a metal expert, or a metal theft expert for that matter. But, according to the article, $6 million in metal was stolen statewide in 2006. These stolen products range from copper wire on farm pumps to parts of a hospital's radiation machine and cemetery urns, affecting the emotional and physical health as well safety of people using 911, night lights at parks and farms' wind machines.

Many supporters of the bill - including law enforcement - blame much of the problem on drug addicts stealing metal to make quick sales for cash to buy more drugs.

Okay, so what does this have to do with privacy you probably are asking (and I am too)?

Let's go to the article in the Visalia Times Delta for the answer:

The Senate Public Safety Committee passed Assembly Bill 844 after it was amended to restrict the release of a thumbprint that scrap dealers must obtain from sellers of metals such as copper, stainless steel and aluminum other than beverage containers.

...its primary opponent, the American Civil Liberties Union, continued to oppose the measure even while conceding that the amendments were an improvement. "We object to government having business collect the fingerprints of their customers," said ACLU lobbyist Tiffany Mok.

The amendment requires a court-ordered warrant before a dealer must release a seller's thumb print.

...

Right now, dealers are supposed to keep a written record of sales or purchases that include place and date of sale, name, driver's license number and state, license plate number and state, plus description of the junk metal. AB 844 would add a thumbprint to records dealers must keep and require them to pay most sellers by check or delay cash payment for three days to allow for possible theft reports.

I'm not going to pretend to be an expert on this, but as I've said before, here, and to the press, that I am always a bit skeptical when the failed and ever expanding "war on drugs" (and sometimes crime, or both) is used as an argument to rationalize the continued assault on the individuals right to privacy.

Click here for the full article.

Prescription Data Used To Assess Consumers

And here I thought that the defeat of SB 1096 in the California Assembly was a landmark victory for the right to keep ones prescription medical records private! While it did represent a critical victory over drug marketers, pharmaceutical companies and retailers, the bad news is that health and life insurance companies have recently developed a "powerful new tool" to access consumer prescription drug records.

By accessing peoples' health "credit reports" - drawn from databases containing prescription drug records on more than 200 million Americans - these companies say they can better determine whether to cover individual consumers.

The Washington Post Reports:

Collecting and analyzing personal health information in commercial databases is a fledgling industry, but one poised to take off as the nation enters the age of electronic medical records. While lawmakers debate how best to oversee the shift to computerized records, some insurers have already begun testing systems that tap into not only prescription drug information, but also data about patients held by clinical and pathological laboratories.

...

But the practice also illustrates how electronic data gathered for one purpose can be used and marketed for another -- often without consumers' knowledge, privacy advocates say. And they argue that although consumers sign consent forms, they effectively have to authorize the data release if they want insurance.

"As health care moves into the digital age, there are more and more companies holding vast amounts of patients' health information," said Joy Pritts, research professor at Georgetown University's Health Policy Institute. "Most people don't even know these organizations exist. Unfortunately the federal health privacy rule does not cover many of them. . . . The lack of transparency with how all of this works is disturbing."

Ingenix and Milliman create the profiles by plumbing rich databases of prescription drug histories kept by pharmacy benefit managers (PBMs), which help insurers process drug claims. Ingenix, for instance, has servers in the PBM data centers, updating the drug files as frequently as once a day...

...

Ingenix and Milliman officials stress that they provide data only with the patient's consent, as required by the Health Insurance Portability and Accountability Act (HIPAA), a 1996 law that governs personal health records information. But HIPAA does not give the Department of Health and Human Services the ability to directly investigate or hold accountable entities, such as pharmacy benefit managers or companies such as Ingenix and Milliman, who are not covered by HIPAA.

A health privacy proposal pending in Congress would expand federal officials' ability to regulate such "downstream" organizations, audit their activities and impose civil fines. The bill also includes a prohibition on the sale of electronic medical records.

Tim Sparapani, senior legislative counsel at the American Civil Liberties Union, said that the products that Ingenix and Milliman are marketing represent the "commodification" of electronic medical records by third parties. "We've got to stop these practices before the marketplace is fully developed and patients lose all control over their medical information," he said.

The fight over control of ones private prescription records appears to be just getting started, and the more health records become electronic, the more parties will compete to sell more comprehensive patient information to insurers, further driving down prices, and the cycle continues.

Let's hope Bob Gellman's privacy protection tool (an independent privacy consultant in Washington) that requires users to consent before specific data, such as prescription histories, can be released, becomes the industry standard. But as he states, "To work, the tool must be independent of all who hold the data."

Click here to read the complete article.

Lawmakers Seek Data On Targeted Online Ads

Here's some good news, the House Energy and Commerce Committee is expanding its inquiry into potential privacy violations of online advertising that is targeted based on consumers' Web-surfing activities.

The lawmakers have written to 33 telecommunications businesses to learn whether, how and when Internet companies might have engaged in such practices. Their aim in part is to determine whether existing laws sufficiently protect consumers' privacy in online behavioral advertising or whether new legislation is needed.

The Washington Post reports:

A key issue for some of the lawmakers is whether consumers are given sufficiently clear notice about what information is collected, how it is used to target ads and whether consumers have control over the use of the data.

Some, like Rep. Edward J. Markey (D-Mass.), chairman of the panel's telecommunications subcommittee, said at a hearing on the subject last month that consumers "deserve one clear, conspicuous" notice about the data collection and should not be sent targeted ads unless they give their consent -- what he termed "meaningful opt-in consent."

I'll be very interested to see what they uncover. I would not at all be surprised if the data gathering techniques used by industry are far more invasive than initially thought.