Janet Napolitano's Record on Privacy Not So Good

As we continue to wrestle with that all important intersection between civil liberties and technology - one that is becoming more and more difficult to navigate - the importance of understanding how government officials view that issue, and privacy itself, only grows.

Accordingly, there are few public offices of greater importance as related to privacy, technology, and civil liberties than the head of the Homeland Security Department. Thomas Frank - an author I admire greatly - takes this issue on in a recent article in the USA Today I found to be particularly enlightening.

Gov. Janet Napolitano is of course President-elect Barack Obama's pick to run the Homeland Security Department, and she has been an enthusiastic advocate for advanced security technology as a law enforcement tool, raising concerns among civil liberties groups that warn about privacy invasion while drawing praise from law enforcement organizations.

Frank writes:

As Arizona's Democratic governor since 2003, Napolitano has:
• Pushed state police to use cameras that scan license plates of moving cars to find vehicles that are stolen or linked to a criminal suspect.
• Promoted "face-identification" technology that could help surveillance cameras find wanted people by comparing someone's face with a photo database of suspects.
• Signed a 2007 bill making Arizona one of 12 states that collect and store DNA samples of people accused but not convicted of certain crimes, including murder, burglary, sexual assault and prostitution.
• Proposed an optional state ID for legal citizens only that features a radio-frequency chip to allow authorities to read the card. State lawmakers blocked the effort this year.

"She sees technology as the panacea of all our law enforcement problems and immigration issues," said Alessandra Soler Meetze, head of Arizona's American Civil Liberties Union chapter. "It's like she's embracing these technologies without taking the time to appreciate the privacy implications."

...

If confirmed as Homeland Security secretary, Napolitano will have opportunities to deploy technology, including sensors along U.S. borders and airport body scanners that look for weapons on passengers by taking images underneath clothing.

It appears that by the least privacy advocates will have their work cut out for them in the coming years on a host of issues ranging from "face identification" technologies to collection of DNA samples to airport body scanners to technology driven border patrol.

Click here to read the article in its entirety.

Top 10 Security Breaches of 2008

I'll try not to end the year frightening anybody, but 2008 was another reminder that the rapid rise in the number of identity thefts and data security breaches are showing no signs of slowing.

This top 10 list put together by bankinfosecurity.com is enough to worry anyone...but they do provide "valuable lessons learned" for each disaster.

Linda McGlasson reports:

The August arrest of 11 alleged hackers accused of stealing more than 40 million credit and debit cards brings law enforcement closer to closing what is still the largest hack ever. The U.S. Department of Justice brought charges against 11 alleged hackers from around the globe. Some of the hacking gang were nabbed and brought to the U.S. to face trial alongside three U.S.-based defendants. Two of the defendants, Christopher Scott and Damon Patrick Toey, have already pled guilty in the case. Others including the ringleader, Alberto Gonzalez, await trial.

Lesson Learned: The wide-range of the perpetrators brings to light something that those in the cyber intelligence realm have known for some time: Criminal hackers are part of a very mature and multi-billion dollar industry that reaches around the world. No organization is immune to the threat.

...

An unencrypted backup tape with 4.5 million customers of the Bank of New York Mellon went missing on Feb. 27, after it was sent to a storage facility. The missing tape contains social security numbers and bank account information on 4.5 million customers - including several hundred thousand depositors and investors of People's United Bank of Connecticut, which had given Bank of New York Mellon the information so it could offer those consumers an investment opportunity.

Lesson Learned: For Bank of New York Mellon, know that when data is released to a third-party that their security is as good or better than yours. Encryption isn't just something that is good for the data held at an institution; it's also something to consider for data that leaves the institution.

Those were the first two on the list...click here to read about the other eight.

How bad of a mess is Obama inheriting with Real ID?

I just want to briefly follow up on my December 12th post that delved into the question where Obama/Napolitano might stand in regards to REAL ID. In that post, I made the point that we really don't know a whole lot about how the new administration will approach the program. I stated:

Here's what we do know: Janet Napolitano opposed REAL ID as Governor of Arizona, but did so on the grounds that it was too expensive and burdensome for the states to implement. I have yet to read any strong statement from the Director of Homeland Security to be on the issue of privacy and the concept of a National ID card...Making matters worse, or at least less clear, is President Elect Obama's near silence on the issue, with a couple quips here and there about "it being too expensive and burdensome for states", (I'm paraphrasing). Again, this isn't exactly the kind of condemnation and outright opposition we would hope for.

I found a useful addendum to that post in an article written by the same author in Computerworld today. Let's just say the program is an unadulterated mess...

Jaikumar Vijayan writes:

As President-elect Barack Obama prepares to take office, it's unclear how his administration will proceed on the technology-heavy Real ID program. But what is all too clear is that the three-year-old effort to impose identification-card standards on state governments remains mired in controversy.

...

There's no mandate that states issue Real ID cards. But eventually, all citizens will need IDs that comply with the requirements in order to board planes, enter federal buildings and receive federal benefits.

The outpouring of protests has prompted the DHS to ease up on its implementation deadlines. For instance, under the final rules set by the agency last January, existing driver's licenses will continue to be accepted as federal identification until December 2014. And people who are age 50 or above at that time won't have to show Real ID cards for another three years.

...

At this point, the only reasonable way forward is for the DHS to work more cooperatively with states on Real ID implementations instead of continuing to "dangle sabers over their heads," said Chris Dixon, an analyst at Input, a government IT consulting firm in Reston, Va.

I think it goes without saying that an Obama/Napolitano team will bring with it a lot more common sense and basic respect and understanding of the Constitution...but big questions still remain...like are we still headed towards a National ID?

Click here to read the article in its entirety.

Top Congressional Democrats Complicit in Spying Too?

As month after month went by with little or no action from Democrats in Congress on the issue of wiretapping - ending with the passage of a FISA bill that EXPANDED executive power and gave the telecoms retroactive immunity - a question that surely must be posed is why? Why has the Democratic leadership been so asleep at the wheel on this issue?

One prominent reason - many believe - is due to the complicity in the program by leading Congressional Democrats. This argument has been made especially effectively by Salon.com's Glenn Greenwald, and has now been confirmed by none other than Dick Cheney in one of his recent "historical revisionism world tour" interviews. With Cheney one can never tell if he's lying or telling the truth, but I lean towards accepting, at least to a degree, his assertions on this issue. As Greenwald notes, by the least the Democratic leaders Cheney names should respond to his claims...and if they don't, the guilt and complicity become all the more apparent.

Greenwald writes:

Dick Cheney's interview yesterday with Fox's Chris Wallace was filled with significant claims, but certainly among the most significant was his detailed narration of how the administration, and Cheney personally, told numerous Democratic Congressional leaders -- repeatedly and in detail -- about the NSA warrantless eavesdropping program. And, according to Cheney, every one of those Democrats -- every last one -- not only urged its continuation, but insisted that it be kept secret:

...

Either way, Cheney's general claim is as clear as it is incriminating. According to him, key Congressional Democrats were told about the illegal NSA spying program in detail, and they not only actively approved of it, but far beyond that, they insisted that no Congressional authorization should even be sought, based on what was always the patently inane claim that to discuss the fact that the administration was eavesdropping on our conversations without warrants (rather than with warrants, as the law required) would be to reveal our secrets -- "our playbook" -- to Al Qaeda.

It is certainly true that Dick Cheney is not exactly the most scrupulously honest public servant around. In fact, he's almost certainly the opposite. Still, what he said yesterday was merely an expanded and more detailed version of what has previously been publicly reported and, to some degree, confirmed about the knowledge and support of Democratic leaders for the NSA program.

...

Unsurprisingly, Pelosi, Harman and Rockefeller all voted last July to legalize warrantless eavesdropping and to immunize telecoms from liability, thereby ensuring an end to the ongoing investigations into these programs. And though he ultimately cast a meaningless vote against final passage, it was Reid's decisions as Majority Leader which played an instrumental role in ensuring passage of that bill.

One would think that these Democratic leaders would, on their own, want to respond to Cheney's claims about them and deny the truth of those claims. After all, Cheney's statement is nothing less than an accusation that they not only enthusiastically approved, but actively insisted upon the continuation and ongoing secrecy, of a blatantly illegal domestic spying program (one that several of them would, once it was made public, pretend to protest).

Click here to read the article in its entirety.

CNET Reports: Privacy groups ask Obama for stronger FTC

Now here's a little good news. A who's who in privacy advocacy, including the Privacy Rights Clearinghouse, the Consumer Federation of America, the American Civil Liberties Union, the Center for Digital Democracy, the World Privacy Forum, the Electronic Privacy Information Center, the Privacy Times, the Privacy Journal, the Consumers Union, the Electronic Frontier Foundation, and U.S. PIRG, the federation of state Public Interest Research Groups, met with Obama's transition team earlier in the week to discuss strengthening the Federal Trade Commission...particularly as it relates to consumer privacy.

I can't think of a more respected coalition of organizations to make this important case to the incoming administration...now we'll see whether they're listening.

Stephanie Condon of CNET News reports:

While participating organizations addressed a range of problems and potential solutions, the underlying message was clear: the FTC has for too long allowed industries to self-regulate their online privacy practices--to the detriment of consumers.

...

"We wanted to impress upon the transition team that there are many online privacy issues that need to be the highest priority of the incoming Obama FTC," said Jeff Chester, the executive director of the Center for Digital Democracy. "The last eight years has been a disaster for consumer protection and privacy, and the agency has not really had the interest to work on behalf of consumers to investigate the online ad industry and its harmful and problematic practices."

Along with the need for better regulation of targeted online marketing, the groups discussed the need for more oversight in the data broker industry and privacy policies for medical information, among other things. A range of solutions were offered, from more benchmarks for self-regulated industries to new legislation.

...

...multiple groups at the meeting with the Obama transition team said that behavioral tracking and targeting is still a problem that the FTC needs to address. Susan Grant, director of consumer protection at the Consumer Federation, called the practice "deceptive on its face."

"The FTC approach to this issue is emblematic of its timid and inadequate approach to consumer privacy in general over the past several years," she said. "Information is collected by entities with whom people have no relation, without consumers having any idea of what would be done with that information."

The Consumer Federation is calling for the FTC to establish a "Do Not Track" registry, Grant said. The FTC already oversees the Do Not Call Registry, which lets consumers opt out of receiving telemarketing calls. The registry has been very successful, Hoofnagle said, with telemarketers reporting larger profits and more effective results.

...

The Privacy Rights Clearinghouse, a nonprofit consumer rights group, has received numerous complaints from consumers about companies that sell their personal information, including companies that supposedly violate their own privacy policies, according to the Clearinghouse's director Beth Givens. "This is an unregulated industry that needs to be investigated by the FTC," Givens said. "It's long overdue."

Data brokering may have contributed to the mortgage meltdown of the past year, Hoofnagle said, since Internet users would typically face a deluge of offers from mortgage brokers after making a single inquiry online about how to get a mortgage.

I think you all get the idea...all I can say is I sure would have enjoyed being a fly on the wall at this meeting!

Click here to read the article in its entirety.

Has Big Brother Won? Obama's Wiretapping Challenge

I thought this New York Times op-ed on the difficulty that the Bush administrations extensive and illegal wiretapping and surveillance program poses Obama to be a useful precursor in understanding what's ahead for the next President on this most critical of issues.

Throughout the past years one of the arguments I made incessantly here was that once a President is given new and far reaching powers, its very hard for future President's to give those powers up. I would say that's a very human characteristic in fact...but when it comes to our civil liberties and right to privacy, its a human characteristic that should be avoided.

One of the key legacies of the Bush era will be more than the abuse of power by the Executive, but it will be the way in which "the law" no longer seems to even apply to it...and certainly not in any way close to equal to the rest of us. A point Glenn Greenwald of Salon.com recently made I though was especially salient in this regard.

He pointed out that to eavesdrop on a fellow American citizen is a felony offense punishable by five years in prison or a $10,000 fine if done without warrants. "We have laws in place that say that it is a felony punishable by decades in prison to subject detainees in our custody to treatment that violates the Geneva Conventions or that is inhumane or coercive. We know that the president and his top aides have violated these laws. The facts are indisputable that they’ve done so. And yet as a country, as a political class, we’re deciding basically in unison that the president and our highest political officials are free to break the most serious laws that we have, that our citizens have enacted, with complete impunity, without consequences, without being held accountable under the law.

So with that grave and ominous backdrop to the opportunity and challenges awaiting a President Obama, let's get to Patrick Radden Keeke's analysis in today's NYT's:

After a contentious hearing this month on the most controversial aspect of the new law — a blanket grant of immunity to the telecom giants like AT&T that secretly permitted the N.S.A. to siphon off their customers’ communications — a federal judge in San Francisco must decide whether Congress has the authority to bestow absolution on private companies that appear to have violated the law. One paradox is that Bush administration lawyers have claimed from the outset that the surveillance program was entirely legal, yet they remain desperate to prevent any court from testing that claim. Instead, they are in the odd position of advocating immunity for something that they insist is not a crime.

Another paradox, which Barack Obama surely appreciates, is that the real issue underlying the immunity debate is not whether the telecoms should pay damages; it is whether lawsuits against the companies can be used to answer a question that Congress and the press have not: Just how bad was the N.S.A. program, after all?

Mr. Obama says he does not want his first term to become bogged down in any sort of “partisan witch hunt.” Indeed, the sheer extent of executive lawlessness in Washington over the past eight years has left so many wrongs to right that, in the interests of triage, the new president may choose to let bygones be bygones where wiretapping is concerned. But that would be a mistake.

...

The Obama administration cannot enact the kind of thorough course correction on domestic surveillance that is needed without understanding how far off course the intelligence community got in the first place. Mr. Obama, who initially vowed to filibuster the immunity provision but, under pressure in the race against John McCain, backed down and reluctantly supported it, has committed “to have my attorney general conduct a comprehensive review” of N.S.A. surveillance.

That is a promising first step, but it is not enough. Nor is the prospect of reports due next summer from the inspectors general of the N.S.A. and the Justice Department. The good news for Mr. Obama, politically, is that the executive branch should not lead the charge in investigating the wiretapping. Congress should.

...

Without some baseline understanding of what went wrong — and how wrong — in recent years, and without the establishment of some bright line rules of the road, it would be naïve to think that there won’t be future abuses. For aggressive intelligence agencies, legal ambiguity is an invitation to excess. Wiretapping can sometimes seem forbiddingly complex, and many Americans just aren’t concerned that the government might monitor their calls. But what is at stake here is not mere personal privacy, but the bedrock American principles of separation of powers and the rule of law.

You can be sure I will be following and covering how this issue unfolds in the coming months and years. Click here to read more.

Where does Obama stand on REAL ID?

I can safely and confidently say that I personally can't answer that question yet, not even close. Here's what we do know: Janet Napolitano opposed REAL ID as Governor of Arizona, but did so on the grounds that it was too expensive and burdensome for the states to implement. I have yet to read any strong statement from the Director of Homeland Security to be on the issue of privacy and the concept of a National ID card. This doesn't exactly make me exude confidence when taking part in discussions regarding the future of the REAL ID Act.

Making matters worse, or at least less clear, is President Elect Obama's near silence on the issue, with a couple quips here and there about "it being too expensive and burdensome for states", (I'm paraphrasing). Again, this isn't exactly the kind of condemnation and outright opposition we would hope for.

Just for a quick refresher course, the Real ID Act was approved by Congress - underhandedly as a rider I might add - and then signed into law by President Bush in 2005 as part of the government's effort to combat terrorism. At the time, few lawmakers even knew what they were voting for, or necessarily supported the concept to begin with.

Since that time the law has evoked widespread criticism from privacy advocates and civil rights groups, which say it would create a de facto national identity card system that would be hard to manage and even harder to secure. To learn everything you ever wanted to about this Big Brother power play check out http://realnightmare.org/.

Over the past couple years states across the country have been putting up a concerted and fairly successful fight against the Federal Government - many refusing to implement the program. Even a DHS advisory committee voiced reservations about the Real ID effort last year because of privacy, security and logistical concerns.

So then, what should we expect from an Obama/Napolitano team on this issue?

To get some help answering this question let's go to Jaikumar Vijayan of Computerworld:

Thus far, Obama himself has made almost no public comments about the Real ID initiative, which calls for driver's licenses and other state-issued IDs to include digital photos and be machine-readable so the information on them can be captured by scanning devices. And on the one occasion in which Obama had an opportunity to vote on an issue related to the Real ID Act in the Senate, he didn't cast a ballot.

Meanwhile, Arizona Gov. Janet Napolitano, Obama's choice to be secretary of the U.S. Department of Homeland Security (DHS) — the agency responsible for implementing the Real ID rules — previously signed a bill barring her state from participating in the program. Given that fact, it's uncertain how effective she would be in pushing for adoption of Real ID in her expected new role or if she would even be inclined to do so in the first place.

...

Other provisions in the Real ID law require participating states to store digital images of IDs for seven to 10 years and for their driver's license databases to be linked to essentially create a single large system with shared access. There's no mandate that states issue Real ID cards. But under the law, all citizens will eventually need ID cards that comply with the Real ID requirements in order to board planes, enter federal buildings and receive benefits from the federal government.

...

...after initially setting a deadline of last March for states to request an extension on meeting an initial set of Real ID requirements that were supposed to be implemented by May, the DHS backed off of threats to begin enforcing the law's rules, even going so far as to issue extensions to states that didn't actually ask for one.

Those moves weren't just an attempt by the DHS to appease state officials who are opposed to Real ID, Harper said, adding that the agency decided to slow down and pass the baton to the next administration. DHS officials "realized there's just no way they're going to win this" by taking a confrontational approach, he said.

...

Estimates that the final tab for the Real ID program could exceed $17 billion also make it a challenge to push forward, according to Harper. Even so, he doesn't expect Obama to seek an outright repeal of the law because that would likely generate criticism that the new president was being soft on terrorism and immigration-control issues.

...

According to Dixon, the one public comment that Obama has made about Real ID came during a primary campaign debate, when he voiced his opposition to the way the law was being implemented and the burdens it imposed on states. A perusal of Obama's Senate voting record on the Project Vote Smart Web site shows that as a senator from Illinois, Obama didn't vote on a proposal relating to Real ID funding.

So all in all, I'm relatively confident that this program as initially envisioned is dead. Too many states don't want anything to do with it, and I don't sense Obama or Napolitano are real enthusiastic about it either. But, there are "middle grounds" that will sure to be discussed and debated, and I can only hope that the President Elect puts the Constitution above any fears he may have of looking "soft on terrorism" by killing REAL ID altogether.

My guess is some kind of hybrid program will evolve, based on some of the things states are already doing, and then coming to some agreement on what "bar" is acceptable for all states to meet the program's required standards. If this is the case, we probably should expect this issue to be far from over, because there are many groups and states out there that believe, on principle, REAL ID is an abomination...and they will not give in easily.

Click here to read more.