ACLU Launches MUCH NEEDED DotRights Campaign

My friends at the ACLU, with special thanks to Nicole Ozer, the Norther California branch Technology and Civil Liberties Policy Director, have launched an exciting, and what I consider to be an incredibly important campaign called"DotRights".

The campaign was launched yesterday with an ENORMOUS task in front of it: both educating the public about our right to control our data on the Internet and throughout our evolving cyberspace reality, as well as the concrete steps we need to take to protect our privacy rights. And as the campaign notes, some fairly broad rights were granted - though its intent is rarely followed - to each and every one of us by the Electronic Communications Privacy Act of 1986.

In other words, while the campaign's goal and challenge appear to be almost revolutionary in scope, the fact is its making a rather simple point: the law itself is not currently being followed (or at least its intent) when it comes to our privacy and the use of our personal data on the Internet and its time it is. For that to happen, the rules of the game must be strengthened and updated (i.e. brought into the 21st Century). I'm in!

In a statement released yesterday as the group unveiled its slick, interactive, and informative Web site called, as you might guess: dotrights.org, the ACLU said its goal was to "spotlight the need to upgrade laws protecting consumer data".

For anyone that ever reads this blog you probably already are aware of the myriad of ways in which companies and government agencies take advantage of both a lax legal landscape that allows massive amounts of our personal data to be collected and sold simply based on our browsing habits...and the lack of consumer understanding of this growing business practice.

Think behavioral marketing, think Google books, think Facebook, think the coming smart grid, think locational tracking, think government surveillance, and so on, and so forth. The list is becoming infinitely long as today's information economy grows and evolves...which is precisely the point of the ACLU'S DotsRights effort.

Check out this particularly useful tool on the site...as it takes you through step by step how your data can be used for purposes other than what you want it to be...

Among some of the specific policy recommendations being made by the site, we've got updating Internet privacy laws (a major theme I highlight on this blog: the need for regulation to catch up with technological innovation) - such as new legislation forcing Web sites to disclose what information they gather about users and permitting those visitors to have their information deleted free of charge.

But enough of my description of the campaign, let's get to Nicole Ozer's, as published in the California Progress Report yesterday.

Nicole writes:

Your life, your data. Or is it? When we update our status on Facebook, post those photos on Flickr, or shop for holiday gifts on Amazon, a whole lot happens behind the scenes. The more we do online, the more digital footprints we leave behind. Many sites we visit collect detailed information about us—our politics, hobbies, relationships and more.

Outdated privacy laws often fail to keep your personal information from being shared, sold, or handed over to a snooping government—without a warrant! And the government and some Web companies don't exactly want us to connect the dots.

...

Online companies regularly receive demands for personal information about their users—with little to no judicial oversight. Facebook reportedly receives up to 100 demands each week seeking information about its users. AOL reportedly receives 1,000 demands a month.

In 2006, a U.S. Attorney demanded book purchase records of 24,000 Amazon.com customers. (In a show of loyalty to users, the company successfully fought back against the subpoena.) Other companies, like Google, don't make public how often information about their users is demanded or disclosed.

No one should be forced to choose between using the Internet and keeping their personal information from being misused. We shouldn't have to pay for these seemingly free online services with personal details about our lives.

That's where the ACLU of Northern California's new Demand Your dotRights campaign comes in. It provides a behind-the-scenes look at everything from social networking, to photo sites, to search engines. The campaign helps you connect the dots to see how your favorite online activities make it harder for you to keep your private information, well, private. If you've seen our ACLU Facebook quiz, you're already aware of the problem—but that's just the tip of the iceberg.

...

Consumers clearly want more control over personal information, so it's good business for companies to join consumers in demanding a privacy upgrade. A 2009 national telephone survey conducted by the University of California, Berkeley, and University of Pennsylvania revealed that 92% of American adults believe they should retain the right to delete their information from a site, and 69% feel there should be a law that gives people the right to know everything that a website knows about them.

Click here to read the rest of the article.

Revised Google Book Search Court Settlement Fails to Address Core Privacy Concerns

I'm guessing everyone is aware of one of Google's latest ventures that, as one might have guessed, poses a threat to privacy rights: A dramatic expansion of its Google Book Search service. I've written about this in the past here, particularly the court battle that has been underway over the service pitting the Electronic Frontier Foundation, the ACLU, and the Samuelson Clinic (from the Berkeley Center for Law & Technology) against the technological Juggernaut, and privacy allergic Google.

As I have noted in the past, the good news is that millions of books will be available for browsing and reading online. The befuddling question remains however as to why Google continues to refuse to bring privacy protections into the 21st Century along with its innovative products. Under its current design, Google Book Search can monitor the books you browse, the pages you read, and even the notes you take in the "margins."

Thus, without strong privacy protections, as the ACLU has outlined so well, all of our browsing and reading history could be collected, analyzed, and turned over to the government or third parties without our knowledge or consent.

But before I go deeper into the privacy implications of the service and ways to address them, let's discuss the revised court settlement regarding Google Book Search that was just released this past Friday (hint: its done little to assuage concerns of privacy advocates).

The University of California, Berkeley's, Pamela Samuelson, a law professor and director of the Berkeley Center for Law & Technology, noted:

I also raise questions about user privacy. There are dozens of provisions in the settlement agreement that call for monitoring of what users do with books and essentially no privacy protections built into the settlement agreement. While I think that there were some substantial changes that were made to it, it more had to do with getting foreign rights holders out of the settlement and trying to respond at least in part to issues that the Department of Justice raised. So I think there are dozens and dozens of issues that were raised by objectors to the settlement agreement that are, in fact, not addressed in this revision.

Here's more on the ruling from Wendy Davis of mediapost:

Civil liberties organizations have pointed out that the agreement leaves Google in a position to amass at least as much in-depth information about users' reading habits as libraries. For that reason, groups like the Electronic Frontier Foundation have said the settlement should have terms obligating Google to protect users' privacy -- such as provisions requiring the deletion of loggin information. Instead, the amended pact merely says that Google won't share private information with the registry without "valid legal process."

This promise doesn't go nearly far enough to solve the privacy problems posed by a digital book registry. First, requiring "valid legal process" doesn't set the bar all that high considering that any judge can rubber-stamp a subpoena requiring Google to disclose information about readers. Sure, Google can challenge subpoenas in court, but nothing in this agreement appears to require the company to do so.

...

The reality is, as long as Google plans to collect and retain information tying users -- or even IP addresses -- to reading material, users' privacy is vulnerable...If Google doesn't want that to happen, the company should agree to some new limits on its ability to collect and retain data about the books that people read online.

Click here to read more.

I don't think its too much to ask, as the ACLU has advocated, that Google promise it will protect reader records by responding only to properly-issued warrants from law enforcement and court orders from third parties. It also must promise that it will tell readers if anyone demands access to information about them, before that information is disclosed if possible.

If none of this takes place, and no additional protections are afforded users, EFF and the ACLU warn that Google Books could "become a one-stop shop for government surveillance into the reading habits of millions of Americans."

As I wrote a month back, we're not talking about just another library mind you - librarians utilize a different standards for dealing with user information than does the online world. Many libraries routinely delete borrower information, and organizations such as the American Library Association have fought hard to preserve the privacy of their patrons in the face of laws such as the U.S. Patriot Act. The concerns of privacy advocates are not hypothetical - nor should they be discarded as paranoia.

Our country has a long history of government efforts to compel libraries and booksellers to turn over customer records and information. Why would anyone believe, particularly after the warrantless wiretapping scandal, that the government won't ask a company like Google to turn over the treasure trove of private personal information it has on millions of Americans? For these reasons and more, it is essential that Google Book Search incorporate strong privacy protections.

The ACLU lays out how users privacy should and could be better protected:

Limited Tracking: Just as readers can anonymously browse books in a library or bookstore, they should be able to anonymously browse, search, and preview books using Google Book Search. Google must allow users to browse, search, and preview books without being forced to register or provide any personal information. Google must not keep logging information for any of its Google Book Search services longer than 30 days. In addition, Google must not link any information about a reader's use of Google Book Search with any information about that reader's use of other Google services without specific, informed consent.

User Control: Readers should have complete control of their purchases and purchasing data. Readers must be able to review and delete their records and have extensive permissions controls for their "bookshelves" or any other reading displays. Readers also must be able to “give” books to anyone, including to themselves, without tracking. Google also must not reveal any information about Google Book Search use to credit card processors or any other third parties.

User Transparency: Readers should know what information is being collected and maintained about them and when and why reader information has been disclosed. Google must develop a robust privacy policy and publish annually the number and type of demands for reader information that are received. Google needs to know that readers will not pay with digital books with their privacy. The time is now to make sure that Google doesn't close the book on reader privacy.

You can join the ACLU and EFF's effort here.

Google Voice Violates Google's Privacy Policy

I've done a whole lot of posts on Google and their ever expanding technological empire and the rather confrontational relationship its had with privacy advocates that can add some perspective to this latest "privacy snafu" (all be it a minor one).

I've written about the approaching launch of Google Books just around the corner in which the ACLU, Electronic Frontier Foundation, and the Samuelson Clinic have even launched a Google Book Search privacy campaign to address.

I've written about the loss of "Locational Privacy" and how a host of Google products relate to that growing privacy protection challenge.

And I've posted a lot about other examples demonstrating Google's less than stellar record on privacy in the past, from their lobbying efforts in Congress, to cloud computing, and to its increasing usage and expansion of behavioral marketing techniques.

In a nutshell, as I wrote a few months back, "It's inarguable that Google is rapidly becoming the official technology sponsor of the nation and globe. For the sake of argument, let's just accept this as truth, and assume this company's reach and breadth will only grow. With that in mind, it becomes paramount - and beholden on all those that relish privacy - to keep a close eye on this global leader's attention to this constitutional protection as it relates to their technological innovations.

While it might be an exaggeration to say that Google has been hostile to privacy advocates and their concerns, they've been resistant to say the least. Google has become a concern for advocates for a myriad of reasons, stemming from their lobbying activities to the actual privacy implications of some of their product lines."

With that, the Washington Post published an article in last Friday's edition entitled "How Google Voice Violates Google's Own Privacy Policy", in which it details how the Google Voice service systematically replaces friend's phone numbers with their Google Voice numbers when they call, even when they aren't calling from Google Voice. As the author notes, this is a clear violation of Google's own privacy policy.

Michael Arrington of TechCrunch.com writes:

Here's how this works: Let's say you signed up for Google Voice sometime in the past. The main benefit of Google Voice is that it forwards calls to your other phones "one number for life" thing. So you probably told Google Voice a few of your other phone numbers, home, work, mobile, etc. And then perhaps you stopped using the service after testing it.

Now if you call my Google Voice number from any of those real phone numbers that you told Google about, the caller ID and archived information on Google Voice (missed and received calls, voicemails) says your Google Voice number, not the number you are calling from.

That creates confusion. If I have your mobile number stored in my phone, it doesn't recognize the Google Voice caller ID and I tend to ignore the call. Then I read the transcribed voicemail and realize it's someone I know. I check my address book and the number isn't right, though. I add the new number and maybe delete the old one, thinking you've changed phones. It's a mess.

Inbound text messages have the same problem. And if I return the text message and you don't have the feature turned on to your real mobile phone, you won't get them.

...

What if you sent me an email from your work account to my Gmail account, and Google automatically changed the from address to your Gmail account? This is a direct analogy to what's happening with Google Voice.

And it's a clear violation of Google's privacy policy, which states:

Information sharingGoogle only shares personal information with other companies or individuals outside of Google in the following limited circumstances: We have your consent. We require opt-in consent for the sharing of any sensitive personal information. We provide such information to our subsidiaries, affiliated companies or other trusted businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Privacy Policy and any other appropriate confidentiality and security measures.

We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce applicable Terms of Service, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against harm to the rights, property or safety of Google, its users or the public as required or permitted by law.

Click here to read more.


As noted by the author, none of the exceptions listed in the privacy policy apply to this case, and as such, Google needs to add an opt in for this feature. As it is, Google wants consumers who have Google Voice to use that number, and this problematic feature is a way of ensuring this happens.

Nonetheless, as again the author notes, just because someone gives you one of their phone numbers doesn't mean they want to give you their Google Voice number. Maybe they abandoned the service. Or maybe they just don't want you to have that number. Regardless, this is a clear example of an "opt-in" feature.

EFF Battles US Government Over Efforts to Subpoena Info on Left Wing Site's Visitors

Now here's one of those "holy crap there really is a Big Brother" type stories. Apparently my friends at the Electronic Frontier Foundation (EFF) have been tangling with the US Government over its efforts to subpoena the IP address of every visitor to a left leaning political website called IndyMedia.us. But that's not all, the grand jury subpoena also required the site "not to disclose the existence of this request" unless authorized by the Justice Department.

Just what in the hell is going on here? And what does it say about online journalism and privacy rights? One problem with this government subpoena is that its illegal. It's also disturbing and, how can one say it?: "antithetical to the founding principles of our country"!

Before you start thinking "Oh no, another Obama Adminstration betrayal" let me point out that the subpoena from U.S. Attorney Tim Morrison was filed on June 25, 2008...during the good ole' Constitution burning Bush years.

A report published by EFF, describes how these U.S. attorneys issued a federal grand jury subpoena to Indymedia.us administrator Kristina Clair demanding “all IP traffic to and from www.indymedia.us" for a particular date, potentially identifying every person who visited any news story on the Indymedia site.

Among other things, it instructed Clair to "include IP addresses, times, and any other identifying information," including e-mail addresses, physical addresses, registered accounts, and Indymedia readers' Social Security Numbers, bank account numbers, credit card numbers, and so on.

After talking to other Indymedia volunteers, Clair ended up calling the Electronic Frontier Foundation in San Francisco, which represented her at no cost.

EFF Senior Staff Attorney Kevin Bankston explains that this overbroad demand for internet records not only violated federal privacy law but also violated Clair’s First Amendment rights, by ordering her not to disclose the existence of the subpoena without a U.S. attorney’s permission. Other problems with the subpoena, include that it was not personally served, that a judge-issued court order would be required for the full logs, and that Indymedia did not store logs in the first place.

As Bankston notes, "Because Indymedia follows EFF’s Best Practices for Online Service Providers and does not keep historical IP logs, there was no information for Indymedia to hand over, and the government withdrew the subpoena. However, as the report describes, that wasn’t the end of the tale: Ms. Clair wanted EFF to be able to tell the story of the subpoena and shine a light on the government’s illegal demand, yet the subpoena ordered silence. Under pressure from EFF, the government admitted that the subpoena’s gag order had no legal basis, and ultimately chose not to go to court to try to force Ms. Clair’s silence despite earlier threats to do so."

Bankston then sums up why this story is important:

This story is an an important example of how government abuses breed in secrecy, and an argument for Congress to step in and require meaningful reporting about how the government uses its surveillance authorities. How often does the government attempt such illegal fishing expeditions through internet data? How many online service providers have received similarly bogus demands, and handed over how much data, violating how many internet users’ privacy? How many of those subpoena recipients have been intimidated into silence by unconstitutional gag orders?

...until Congress exerts stronger oversight, we can’t know, except in those occasional instances where a brave online service provider steps up, pushes back, and tells the world. We encourage other online service providers to follow the example of Indymedia.us and Kristina Clair by standing up for their users' rights when the government secretly overreaches. If you're an ISP, a web host, an email provider, an app developer, a Web 2.0 start-up or any other kind of online service provider and you receive a government demand for your users' data, please call a lawyer. If you don't have a lawyer, call EFF.

As noted by CBS news, this is not the first time that the Feds have focused on the liberal Indymedia Web site whose that hosts a myriad of activist writers and advocates. In 2004, the Justice Department sent a grand jury subpoena asking for information about who posted lists of Republican delegates while urging they be given an unwelcome reception at the party's convention in New York City that year. A Indymedia hosting service in Texas once received a subpoena asking for server logs in relation to an investigation of an attempted murder in Italy.

The fact that the government is actively targeting liberal media sites should be a concern to everyone.

For a full fleshing out of this story, the EFF report is the place to go. For those without the time to read it all, here is the closing summation entitled "Closing Lessons":

The experience of Ms. Clair in dealing with the subpoena for Indymedia's logs brings with it several lessons — not only for online service providers but also for the average Internet user, Americans who care about civil liberties, and Congress.

The first lesson is for the average Internet user: yes, your IP address can be and typically is logged by the online services that you use, and yes, the government can obtain those logs, sometimes with only a subpoena issued directly by a prosecutor. If you want to anonymize your IP address to prevent the violation of your online privacy, you can use anonymizing software such as "Tor". You can find out more about Tor and how it works in this section of EFF's Surveillance Self-Defense Manual and at http://www.torproject.org/.

For online service providers, the second lesson is straightforward, and one that EFF has highlighted both in its "Best Practices for Online Service Providers" and its Surveillance Self-Defense manual: if you don't have it, they can't get it. When providers avoid keeping unnecessary Internet logs, responding to subpoenas and other legal demands for such information becomes very simple: "Sorry, but we don't keep those logs and so we don't have any information that's responsive to this subpoena."

The third lesson, again for providers, is that they can and should seek legal advice when they receive legal demands for information. Without a lawyer's advice, providers may hand over data that the government isn't legally entitled to or that the provider is legally forbidden from disclosing, and may be cowed into silence by bogus gag demands.

For example, assume that the subpoena in this case had been served on a service that did keep logs of site visitors' IP addresses. Without advice from counsel like EFF, the recipient would not have known that the request, purportedly based on the SCA, actually violated the SCA, and that providing the information to the government could have created liability for the service provider.

Nor would the provider have understood that the subpoena's purported requirement of secrecy was actually an unenforceable request, or that if there was a gag order it could be challenged in court on First Amendment grounds. Absent advice from a lawyer, the provider's unquestioning silence would unnecessarily add to the growing fog of secrecy that surrounds the government's practices in this area.

This leads to our fourth and final lesson, for members of Congress and their constituents: the level of secrecy surrounding how the government uses its surveillance authority under the Stored Communications Act encourages abuses. Sunlight is the best disinfectant, and the best protection against such abuses is more clarity and transparency when it comes to how the SCA is used. Americans who care about civil liberties should press Congress to update the SCA to further clarify what it does and does not authorize, and to require detailed public reporting about how the statute is used, just like the federal wiretap statute requires annual reports on law enforcement's wiretapping activities.

Without such reform, we may never know how often the government issues unlawful demands like the one described here, or how often providers secretly comply with those demands. The government must be held accountable for its uses — and abuses — of its surveillance authority, and with your and Congress' help, it can be held to account.

Until that day, EFF continues to stand ready to provide assistance the next time the government knocks on someone's door with an unlawful, invalid, overbroad, free speech-threatening, privacy-invasive demand for your sensitive Internet data.

Click here to read the report in its entirety.

For now I'll just send my personal thanks to EFF for their outstanding work!

The Smart Grid and Privacy

At a now annual gathering of privacy advocate leaders in Sacramento yesterday I was given the opportunity to address our state and nation's transition to a smart grid system and the privacy challenges it poses. I have written about the subject on this blog here and here. As such, I thought I'd share the general outline of that presentation, particularly in light of the the approaching decision by the California Public Utilities Commission as to whether separate privacy specific hearings will be held on smart grid.

What is a Smart Grid?

The ubiquitous deployment of monitoring technologies (called smart meters) that will allow utilities to collect detailed info about electricity consumption habits of homes. As such, they will be able to determine how to operate appliances more efficiently, i.e. ice makers will operate only when the washing machine isn't, TVs will shut off when viewers leave the room, 'air conditioner and heater levels will be controlled”, etc.

Similarly, utilities will be able to adjust home energy usage based on times of the day and temperatures and there will be an increased ability to ensure renewable sources of energy are distributed more efficiently.

All of these home gadgets will be wirelessly connected to the Internet so consumers can access detailed information about their electricity use (although when and how this will be done is not decided).

The benefits of such a system are self evident: Reduce energy use and CO2 emissions (maybe 20% per home), prevent blackouts, spur development of renewables, and improved service because utilities will know when service down immediately (among others)

(Note: the system has just ran into its first major hiccup in California, as the energy bills of smart grid homes in the state have skyrocketed, resulting in a lawsuit against PG&E.)

Up to three-fourths of the homes in the United States are expected to be placed on the “Smart Grid” in the next decade. Already, some 8 million "Smart Meters," have been installed in U.S. homes. There will be nearly 50 million by 2012. PG&E installing 13000 per day in California, and overall, three major utilities will deploy 12 million by the end of 2012.

Let me also be clear, I used to work on climate change and other related energy and environmental issues, so the need for such innovations as smart grid represent a critical step forward and an important component to any comprehensive global warming and sustainability strategy. This however, in no way means we should rush its implementation without considering unintended consequences, particularly related to privacy.

Privacy Implications/Threats

The paradox of a smart grid system is that what will ostensibly make it an effective tool in reducing energy usage - information - is precisely what makes it a threat to privacy: Information (ours).

It is this paradox that has led some to suggest that privacy might even be the “Achilles’ heel” of the Smart Grid.

So what's being done to implement the system and develop proper rules and regulations? The Energy Information and Security Act of 2007 asked state PUC’s to answer a series of smart grid implementation and regulation questions. The data access issue (as in who has it), both a consumers right to their information (ideally in real time) as well as a third party's access to it, was addressed - but privacy was not mentioned.

So what are the unintended consequences of such a system? Privacy issues routinely arise when data collected is harmless in isolation, but becomes a threat when combined with other data, or examined by a third party for patterns.

Bob Sullivan, who covers Internet scams and consumer fraud for MSNBC.com, explains this dilemma well:

...others see a darker side. Utility companies, by gathering hundreds of billions of data points about us, could reconstruct much of our daily lives -- when we wake up, when we go home, when we go on vacation, perhaps even when we draw a hot bath.

They might sell this information to marketing companies -- perhaps a travel agency will send brochures right when the family vacation is about to arrive. Law enforcement officials might use this information against us ("Where were you last night? Home watching TV? That's not what the power company says … ”).

Divorce lawyers could subpoena the data ("You say you're a good parent, but your children are forced to sleep in 61-degree rooms. For shame ...").

A credit bureau or insurance company could penalize you because your energy use patterns are similar to those of other troublesome consumers. Or criminals could spy the data, then plan home burglaries with fine-tuned accuracy. Space-aged visions of talking appliances may seem farfetched. They're not.

Data creep will inevitably happen. Already, some consumers are getting statements that compare their use to neighbors' usage -- and "overusage" premium pricing isn't far behind. But what if the comparisons aren't fair? Most families would want to be compared to similar families -- how much power do three teen-ager daughter households use?

Jules Polonetsky, director of The Future of Privacy Forum, states: "The potential benefits of the Smart Grid are fabulous. I just think that it's critical that sober and adequate thinking be done at this stage. We must do this right or we could hamper the rollout of the Smart Grid and you could have folks unwilling to participate...We are trying to help before it's too late...Knowing what’s going on in people’s homes…this strikes at some of our most core values."

Let's also not forget perhaps the greatest threat of all: Hackers. We must consider the potential of the falsification of power usage, passing on charges to a neighbor, disconnecting someone else from the grid, etc.

It's also not hard to envision RFID tagged food and prescriptions filling our refrigerators and cabinets in the future which could be read by these smart meters. Could that information be sold to marketers too?

Could our health insurance go up because we eat too much unhealthy food? Might we start receiving brochures about other prescription drugs that the company believes they might be able to convince us we need based on others we are taking?

Policy Challenges and Solutions

With all that said, here's a few questions we should all be asking:

How much information should you give up to the grid?

Who gets access to that information and why?

How long does that information remain in a database?

And how do we protect it once in the grid?

Ideally, we'd take the European approach, which binds companies to collect as little information as is necessary to complete a transaction, and they must delete the data as soon as it is no longer needed – known as “Data Minimization”. That's unlikely, however.

So a more likely indicator, and an excellent case study, is what's been going on in Colorado. The state public utility commission there was convinced by Elias Quinn CEES, Uni. Colorado Law School, and author of "Privacy and the New Energy Infrastructure", to hold separate hearings dealing with privacy concerns related to the smart grid. He (and likewise Colorado now) breaks down privacy challenges into four general categories including accompanying policy proposals:

1. Who has Access to Data? Consumer consent requirements may vary depending on who is seeking your information. Three categories of interests seeking that data were discussed in Colorado, and different approaches were taken for each:

A. Electric Utilities: Opt-Out because the information is critical to the deployment of smart grid networks and to operating the next generation distribution systems, so when people sign-up for service, they can decline to participate.

B. Automation vendors, smart appliance manufacturers, or other related-but-not-essential companies: a one time Opt-In per manufacturer.

C. Entities wholly unrelated to electricity provision: Opt-In in case-by-case (and I'd add proof of good reason to be able to even ask us). So if insurance carrier seeks to examine a customer's usage data, the customer has to be contacted for her informed consent first, and every time.

And let me add a fourth: Law enforcement should be prohibited, by law, from routine access (but of course can subpoena the data when they have a warrant signed by a judge based on already existing reasonable suspicion).

2. How Data Managed? The EU's Data Directive has been cited as a good model, though again, we are far from realizing this here in the states: [1] processed fairly and lawfully, [2] sought or collected for specified purposes, and analyzed only for those purposes, [3] merely adequate and not excessive for the purposes motivating its collection, [4] kept accurate, and [5] kept in a form allowing for identification for no longer than necessary.

Electricity customers should have rights of access or to audit the information for accuracy, or perhaps the right to be given the information in a timely and usable manner, that they might seek their own, third party partners in home automation.

3. How Data Protected?: Utilities should be mandated by law, with strong penalties, to protect information against anyone who would like to monitor/steal/subvert it. That means how to best protect: 1. Security of the Database and 2., Security of the Data in Transit (which could be trickier as it is wireless).

Ideally the data at point of transmission in home would be encrypted, but that is expensive and needs to be done as the system built, not after. We may look back at this missed opportunity with regret.

4. Data Breach Notification: There should be notice requirements such that an electricity consumer is notified in the event that personal information is somehow obtained by a party without the requisite consent.

Update on Progress Here in California

As the California Public Utilities Commission decides on a regulatory framework for a smart grid system in our state, CFC has joined with TURN in urging for a more comprehensive review of the privacy threats such a system poses by holding separate hearings on the subject.

We expect a decision in December. It's too late for other groups to file now in this regard, but the PUC is preparing another notice with a new set of questions that we urge more organizations to participate in, and to certainly contribute if possible to any privacy specific hearings that might be granted.

If privacy concerns are not taken into proper consideration than pursuing a legislative solution may be appropriate.

Does Social Networking and Technological Innovation Represent the End of Privacy?

I know, that's a loaded question that deserves a lot more than a yes or no answer. One thing is certain however, with the explosion in popularity of social networking sites like Facebook (and that's to say nothing of company's like Google and the array of privacy challenges many of its products represent), the ability to protect ones personal privacy has become increasingly challenging.

As I have asserted here in the past, it goes without saying that tools like Facebook reveal a considerable amount of information about a user's lifestyle, interests, and goals. Depending on the user's settings, co-workers, employers, and certain family members could have access to information about the user that may be better left unknown.

Recent Facebook flaps highlights growing concerns about the increasingly sophisticated technologies used to track online activities in an effort to more precisely target advertising. What has also become apparent is that these social networking sites have not exactly been forthcoming about how much user information they harvest, share, and with whom.

However, in recent months users have been becoming more and more conscious of privacy concerns, as Facebook has been criticized for not allowing people to permanently delete their accounts and personal information from the site as well as their use of "Beacon" (no longer in use) - a technology that tracks user's online purchases and informs their friends.

The controversy raised by Facebook's use of the Beacon technology - and the subsequent victory of privacy advocates - has helped ignite a larger debate regarding the largely hidden and growing problem of online consumer-tracking and information-sharing.

And this larger discussion - like what does the loss of privacy mean in the age of Facebook - was addressed yesterday in the New York Times by Miyase Christensen, an associate professor of media and communication studies at Karlstad University, Sweden.

The article is entitled "Watching You Watching Me":

New research suggests that 25 percent of people in Britain suffer from some form of paranoia, probably because of a combination of urbanization, globalization, migration, wealth disparity and the media. So would it be right to assume that paranoia will worsen as we move toward complex personal surveillance, the result of the heavy use of social networking sites such as Facebook?

...

On the Internet, surveillance is commerce. The number of Facebook users has soared, followed by MySpace and Twitter, to the joy of marketers. Online industries look for new trends and respond by incorporating social networking features, such as personal profiles, into sites such as YouTube.

The popularity of social networking may be simply a fraternal exchange, or innocent “friendly encounters of the voyeuristic kind.” But it can also be “complicit surveillance” committed by the individual and sinisterly co-opted.

With about 300 million users, a speculative value of $15 billion and advertisers eavesdropping on every move of members, Facebook deserves special attention in the Net-watch society. People use it for everything from political campaigning to post what they ate for dinner. Many users may object to Facebook’s exploitation of their content for commercial purposes, but most go on using it anyway for personal or practical reasons.

Not all. The Electronic Privacy Information Center (EPIC), a public interest research group in Washington, threatened earlier this year to file a formal complaint with the U.S. Federal Trade Commission about a change in the terms of use that Facebook had secretly implemented, which included rights to information even from cancelled accounts.

...

Yet the actual extent of commercial surveillance on Facebook remains murky. According to its privacy policy, Facebook retains the right to collect information about members from other sources such as newspapers, instant messaging services and blogs — “to provide you with more useful information and a more personalized experience.”

Most usersaccept Facebook’s default settings without considering what this means in terms of privacy and or data use. One survey suggests that 45 percent of employers in the United States admit to checking social-networking-site profiles of prospective employees. The actual number might be higher.

By using Facebook, non-American users also consent to have their personal data transferred to and processed in the United States. Users are not notified when and how their data is used. In 2008, the Canadian Internet Policy and Public Interest Clinic, a privacy group, filed a complaint against Facebook for violating Canadian privacy laws. In the United States, some schools and colleges now try to control content on their students’ personal blogs or Facebook pages, raising new questions about freedom of speech.

...

Yet in the absence of effective regulatory mechanisms, using online social media can be risky. The European Commission warned this year that data collection from such sites might lead to a flood of unsolicited advertising or the use of by the governments in ways that compromise civil liberties. There is a complex, multi-layered interplay between the surveillance embedded in communication technologies and everyday personal communications. This is giving way to a new surveillance, where the act is consensual and the guilt (of convenience and pleasure with a cost) is shared.

Click here to read more.

It appears, as the author asserts, and that I have many times here, regulation simply has not kept up with technologically innovation. I think we can all agree that on their own, it is highly unlikely that politicians will lead the charge to regulate big business in order to protect consumer privacy - thus the responsibility for raising awareness and demanding action falls on advocacy groups.

This is no major revelation of course, but it is worth reminding ourselves of on a regular basis because there are an increasing array of ways in which our privacy can be violated, and no one will protect us unless we demand it first.

Obama Administration Using State's Secret Privilege to Protect Illegal Surveillance Program

I think it has become an accepted fact now among privacy advocates and civil libertarians that President Obama has been a grave disappointment on a whole host of issues. This disappointment is not based on some impossible or unrealistic ideal placed upon him.

I'm talking about a now series of positions (and aggressive actions) taken by the Administration that are the absolute opposite of those the President so eloquently and forcefully took as a Senator and candidate be it preventive detention, warrantless wiretapping, the states secrets privilege, and others.

The Administration's recent, and radical interpretation and use of the "state secrets" privilege to block courts from ruling on the legality of the government's domestic surveillance activities only serves to reinforce this feeling of betrayal.

Let's consider the context too: it was just six weeks ago that the DOJ announced voluntary new internal guidelines which, it insisted, would prevent abuses of the state secrets privilege.

Yet here we are with the DOJ embracing Bush "state secrets" theories for the sole purpose - in this particular case - of protecting those that committed crimes that the President vehemently criticized as a Senator and promised to address as a candidate.

Worse, if the Administration is successful in broadening the scope of this "privilege", the Executive Branch will become even more powerful and unaccountable than it already is - serving to validate and reinforce Vice President Cheney's "unitary executive" theory that gained such traction during the Bush years.

Do we really want our Presidents shielded from judicial review or accountability when he/she is accused of breaking the law? Should entire cases be thrown out simply because the Executive Branch claims that there is something in some document that is so secret it will threaten our national security?

It's not as if this latest Administration interpretation of the state secrets privilege should be a surprise to any of us. As a New York Times Editorial noted just five weeks ago (and that I posted about on this blog):

...Attorney General Eric Holder Jr. issued new guidelines for invoking the state secrets privilege in the future. They were a positive step forward, on paper, but did not go nearly far enough. Mr. Holder’s much-anticipated reform plan does not include any shift in the Obama administration’s demand for blanket secrecy in pending cases. Nor does it include support for legislation that would mandate thorough court review of state secrets claims made by the executive branch.

...

In any event, while more stringent self-policing of executive branch secrecy claims is welcome, it is hardly a total fix. Senator Russ Feingold, a Wisconsin Democrat, noted that without a clear, permanent mandate for independent court review of the administration’s judgment calls, Mr. Holder’s policy “still amounts to an approach of ‘just trust us.’”

If the Obama team is sincere about wanting to end state secrets abuses, it will support the State Secrets Protection Act sponsored in the Senate by Patrick Leahy, the Judiciary Committee chairman, and in the House by Representative Jerrold Nadler, a Democrat of New York. The measure contains safeguards to ensure protection of legitimate secrets. But before ruling on a secrets claim, and possibly dismissing a lawsuit, judges would be required to review the documents or evidence in question instead of just accepting assertions in government affidavits.

I suppose we can take some solace that there's also a bill recently introduced by Democrats Chris Dodd (D-CT), Patrick Leahy (D-VT), Russ Feingold (D-WI), and Jeff Merkley (D-OR), which, if passed, would repeal the legal immunity afforded the telecommunications industry for their participation in President Bush's warrantless wiretapping program.

The Obama Administration, as alluded to, has remained mum on both of these bills, each of which are identical to the positions taken by him as both a Senator and Candidate. Of course, not taking an official position on these bills does not indicate neutrality. It doesn't take a rocket scientist to deduce - and thus the Democrats in Congress have received the message loud and clear - that the Administration is very much against both reforms.

Now let me get to Salon.com's Glenn Greenwald - my most reliable source of analysis, insight, and expertise on all kinds of critical issues - most notably those related to privacy and the Constitution.

Before I get to his article, check out the interview he did with Bill Moyers last Friday in which he discusses government war propaganda, preventive detention, the freedom of information act, the states secret privilege and much more:










Now here's his article on the latest Administration efforts to protect Bush Administration surveillance activities. He writes:

The case of Shubert v. Bush is one of several litigations challenging the legality of the NSA program, of which the Electronic Frontier Foundation is lead coordinating counsel. The Shubert plaintiffs are numerous American citizens suing individual Bush officials, alleging that the Bush administration instituted a massive "dragnet" surveillance program whereby "the NSA intercepted (and continues to intercept) millions of phone calls and emails of ordinary Americans, with no connection to Al Qaeda, terrorism, or any foreign government" and that "the program monitors millions of calls and emails . . . entirely in the United States . . . without a warrant" (page 4). The lawsuit's central allegation is that the officials responsible for this program violated the Fourth Amendment and FISA and can be held accountable under the law for those illegal actions.

Rather than respond to the substance of the allegations, the Obama DOJ is instead insisting that courts are barred from considering the claims at all. Why? Because -- it asserted in a Motion to Dismiss it filed on Friday -- to allow the lawsuit to proceed under any circumstances -- no matter the safeguards imposed or specific documents excluded -- "would require the disclosure of highly classified NSA sources and methods about the TSP [Terrorist Surveillance Program] and other NSA activities" (page 8). According to the Obama administration, what were once leading examples of Bush's lawlessness and contempt for the Constitution -- namely, his illegal, warrantless domestic spying programs -- are now vital "state secrets" in America's War on Terror, such that courts are prohibited even from considering whether the Government was engaging in crimes when spying on Americans.

...

If the President can simply use "secrecy" claims to block courts from ruling on whether he broke the law, then what checks or limits exist on the President's power to spy illegally on Americans or commit other crimes in a classified setting? By definition, there are none. That's what made this distortion of the "state secrets" privilege so dangerous when Bush used it, and it's what makes it so dangerous now.

...

Yet here is Obama doing exactly the opposite of those claims and assurances: namely, he's now (a) seeking to immunize not only telecoms, but also Bush officials, from judicial review; (b) demanding that courts be barred from considering the legality of NSA surveillance programs under any circumstances; and (c) attempting to institutionalize the broadest claims of presidential immunity imaginable via radically broad secrecy claims. To do so, he's violating virtually everything he ever said about such matters when he was Senator Obama and Candidate Obama. And he's relying on the very same theories of executive immunity and secrecy that -- under a Republican President -- sparked so much purported outrage. If nothing else, this latest episode underscores the ongoing need for Congressional Democrats to proceed with proposed legislation to impose meaningful limits and oversight on the President's ability to use this power, as this President, just like the last one, has left no doubt about his willingness to abuse it for ignoble ends.

Click here to read the article in its entirety.

And just a quick note on the actual efficacy of such warrantless wiretapping: NOT ONE instance could be cited in a recent Inspector General report that the wiretapping program prevented any attack of any kind, ever. Nor did it lead to the capture of any terrorists.

In light of these facts, one would think that the Obama Administration would come down somewhere at least close to the position that candidate Obama espoused on the campaign trail. Sadly, the opposite has been true.

I'll be back with updates on this case and the legislation in Congress.