============================================================== @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 6.19 November 11, 1999 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org ======================================================================= Table of Contents =======================================================================  Drivers' Privacy Protection Case Heard by Supreme Court  Privacy Advocates Call on FTC to Halt Online Profiling  Appellate Judges Slam Internet Censorship Law  Intelligence Funding Bill Requires Report on ECHELON  IETF Rejects Proposal on Internet Wiretaps  TRUSTe Fails to Launch Investigation into RealNetworks  EPIC Bookstore -- Genetic Secrets  Upcoming Conferences and Events =======================================================================  Drivers' Privacy Protection Case Heard by Supreme Court ======================================================================= On November 10, the Supreme Court heard oral arguments in Reno v. Condon. The case involves the constitutionality of the 1994 Driver's Privacy Protection Act (DPPA), which prohibited the dissemination of information contained in state driving records. In the lower courts, the state of South Carolina had argued that the DPPA unconstitutionally infringed on state powers, in particular the Tenth Amendment right of states to regulate commerce within their own borders. The Government had argued that the DPPA was a valid exercise of the 14th Amendment, which has been interpreted as providing some privacy protections. In oral argument before the Supreme Court, both sides focused on the constitutionality of federal efforts to regulate the procedures of a state agency. Seth Waxman, Solicitor General of the United States, argued that Congress can legislate on drivers' records since the federal government has the authority to regulate interstate commerce as implicated in the selling of drivers' records to private entities. Charles Condon, Attorney General of South Carolina, repeatedly asserted that the law places an undue burden on state agencies and employees. A recent bill, the Department of Transportation and Related Agencies Appropriations Act for Fiscal Year 2000, will likely protect the privacy of state driving records regardless of the Court decides Reno v. Condon. The new legislation denies transportation funding to states that do not obtain explicit opt-in consent before selling or distributing information contained in driving records. EPIC submitted a friend-of-the-court brief in the Condon case, arguing in support of the DPPA. The brief is available at: http://www.epic.org/privacy/drivers/epic_dppa_brief.pdf For more information about Reno v. Condon, see: http://www4.law.cornell.edu/php/orderinquiry2.php3?caseid=2903 =======================================================================  Privacy Advocates Call on FTC to Halt Online Profiling ======================================================================= At a workshop on "online profiling," panelists from EPIC, Junkbusters, the Center for Media Education, Privacy Times, and Privacy Journal called for the Federal Trade Commission (FTC) to immediately halt the practice of online profiling, launch an investigation into the privacy and consumer implications of the practice, and provide recommendations for proper privacy legislation. The workshop, held jointly by the FTC and the National Telecommunications and Information Administration (NTIA) of the Department of Commerce, took place on November 8. Online profiling is the collection of detailed online behavior from uniquely identified Internet users. Online behavior generally refers to records about pages that were viewed and products or services purchased. Many online advertisers use online profiling in order to target advertisements according this past behavior. The privacy concerns arise because this information is not collected with the knowledge or consent of the consumer and is often connected to personally identifiable information like a name or address. Online behavior can potentially reveal information not only about interests or hobbies, but also medical conditions, sexual preferences, and political or religious beliefs. The collection of such information also gives many businesses an unfair advantage in encouraging customers to buy products. At the workshop, a consortium of online advertisers known as the Network Advertising Initiative (NAI) presented a self-regulatory proposal to stave off regulation of data collected over the Internet. The proposal includes notice of what information is collected and how it is used and an opt-out so that consumers can request to not have their information collected from them. EPIC finds the proposal insufficient due to the lack of enforcement by other similar self-regulating agencies like TRUSTe (see item 6, below) and the undue burden that opt-out places on individuals to stop information collection that often occurs without their awareness. A joint press release issued by the privacy groups to halt online profiling is at: http://www.epic.org/privacy/internet/profiling_press_release.html Details about the Public Workshop on "On-line Profiling" are available: http://www.ftc.gov/bcp/profiling/index.htm =======================================================================  Appellate Judges Slam Internet Censorship Law ======================================================================= Two federal appellate judges harshly questioned the constitutionality of the Child Online Protection Act (COPA) on November 4. COPA would prohibit commercial Web site operators from exposing children under 17 to sexually explicit material that is deemed "harmful to minors." The judges suggested that COPA may violate the First Amendment by not specifying which community's standards would apply when assessing content on the Internet. Soon after President Clinton signed COPA into law last year, it was challenged by a coalition of cyber-rights groups and Web publishers, including EPIC and the ACLU. In February, U.S. District Judge Reed issued a preliminary injunction blocking enforcement of COPA, stating that the law would likely fail to survive judicial scrutiny. The government appealed the decision to the U.S. Court of Appeals for the Third Circuit in Philadelphia. In court last Thursday, Senior U.S. Circuit Judge Leonard I. Garth asked the Justice Department's lawyer how the phrase "contemporary community standards" can be defined, given that the Internet is a global communications medium. "It seems to me that in terms of the World Wide Web, what that statute contemplates is that we would be remitted to the most severe community standards -- perhaps those in Iran or Iraq -- where the exposure of a woman's face is deemed to be improper," Garth said. Judge Theodore A. McKee expressed concern with the law's provision that Web site operators could avoid criminal sanctions by instituting age verification mechanisms, such as credit-card numbers, to restrict access by minors. McKee noted that such a screening process could have a chilling effect on adults who would be forced to reveal personal information in order to access material on sensitive subjects, such as homosexuality. Both McKee and Garth openly questioned whether it is possible to create legislation that satisfies the First Amendment and controls children's access to harmful content. Garth said, "I'm not at all sure that, in light of the Web, one can structure legislation which can control" access to online content. For more information on COPA and the full text of Judge Reed's district court ruling, see: http://www.epic.org/free_speech/copa/ =======================================================================  Intelligence Funding Bill Requires Report on ECHELON ======================================================================= The House of Representatives has approved a provision that would require the intelligence agencies to jointly provide Congress with a detailed analysis of the legal standards they apply when conducting signals intelligence, including electronic surveillance. The requirement grows out of the controversy surrounding Project ECHELON, a global surveillance network coordinated by the National Security Agency. The reporting requirement is contained in the final version of the Intelligence Authorization Act for Fiscal Year 2000, which is expected to be approved by the Senate. The report must be submitted in both classified and unclassified form to the Intelligence and Judiciary committees of the House and Senate within 60 days of final passage. It must disclose the legal standards for interception of communications when such interception may result in the acquisition of information from a communication to or from United States persons; for intentional targeting of the communications to or from United States persons; for receipt from non-United States sources of information pertaining to communications to or from United States persons; and for dissemination of information acquired through the interception of the communications to or from United States persons. The reporting requirement was added to the appropriations bill at the insistence of Rep. Bob Barr (R-GA). In a statement released after the House passage of the bill, Barr said, "If American intelligence agencies are intercepting, receiving or distributing communications involving our citizens without court orders, or legal authority, they are doing so outside the bounds of the Constitution. If Project ECHELON exists as reported, all Americans who care about the integrity of our Constitution should be concerned." Last spring, Rep. Porter Goss (R-FL), chairman of the House Intelligence Committee, requested access to legal memoranda on surveillance authority prepared by NSA's General Counsel, but the agency rebuffed the request citing "attorney-client privilege." (See EPIC Alert 6.08). =======================================================================  IETF Rejects Proposal on Internet Wiretaps ======================================================================= In a public, plenary session on November 10, members of the Internet Engineering Task Force (IETF) decided overwhelmingly not to develop technical standards that would facilitate wiretapping of Internet communications. After an hour-long debate, the IETF members resolved the question of whether the standards group should build the kind of surveillance capabilities that are mandated for telephone systems by the controversial Communications Assistance to Law Enforcement Act (CALEA). The Internet Engineering Steering Group and the Internet Architecture Board will soon publish a formal IETF position paper based on the consensus of the membership. Prior to the debate, a group of computer security, cryptography, law, and policy experts sent an open letter to the IETF urging rejection of wiretap standards. They said that "such a development would harm network security, result in more illegal activities, diminish users' privacy, stifle innovation, and impose significant costs on developers of communications." The rejected proposal arose when some IETF members asserted that CALEA required such Internet standards. With the emergence of Internet telephony, some have argued that the law should now be read to cover the Internet. That view, however, is countered by the legislative history of the 1994 law, which clearly stated that CALEA "does not require reengineering of the Internet, nor does it impose prospectively functional requirements on the Internet." The text of the open letter to the IETF is available at: http://www.epic.org/privacy/internet/letter_to_ietf.html The legislative history of CALEA is available at: http://www.epic.org/privacy/wiretap/calea/H_Rpt_103_827.txt =======================================================================  TRUSTe Fails to Launch Investigation into RealNetworks ======================================================================= On November 1, the New York Times reported on the discovery made by independent security consultant Richard Smith that online software distributor RealNetworks was collecting information about the music tastes of 13.5 million Real product users without their knowledge. Despite initially indicating that it would launch an investigation into its licensee RealNetworks, the TRUSTe privacy certification organization has chosen not to pursue an inquiry, citing a loophole in the existing license agreement. TRUSTe claims to provide adequate privacy guidelines and oversight of privacy violations for companies that it certifies. RealJukebox (software downloaded through the site of RealNetworks) was surreptitiously scanning computer hard drives for music files and transmitting information about the genre of music, the format of the music files, and the type of connected music player used back to RealNetworks. This information was also tied to personal information previously collected through registration forms. After the activities of the RealJukebox software became public, RealNetworks provided a software "patch" that would prevent the further transmission of information. TRUSTe refused to launch an investigation since RealNetworks did not technically violate any part of its license agreement. The TRUSTe license agreement only covers information collected from individuals over a website. TRUSTe claimed that since the information collection and transmission occurred through software downloaded at a site, there was in fact no violation of the license agreement. TRUSTe did announce plans to change its license agreement to include software downloaded through a website. This is not the first time that TRUSTe has failed to launch an investigation into an apparent violation of one of its licensees. In March, Microsoft was found to be including Globally Unique Identifiers (GUIDs) within Microsoft Office 1998 that would allow all documents and visits to Microsoft operated websites to be tied with personal information provided through earlier software registrations. As in the case of RealNetworks, TRUSTe found that Microsoft did not violate the TRUSTe license agreement and refused to perform an investigation. Remedies for Real users may still be available; several class action lawsuits have been filed alleging that RealNetworks violated various federal and state laws by secretly collecting data. For more information on the RealNetworks and Microsoft privacy Incidents, see: http://www.junkbusters.com =======================================================================  EPIC Bookstore -- Genetic Secrets ======================================================================= Genetic Secrets: Protecting Privacy and Confidentiality in the Genetic Era by Mark A. Rothenstein http://www.amazon.com/exec/obidos/ISBN=0300080638/electronicprivacA Twenty-three articles by professionals from law, medicine, bioethics, public health, science policy, clinical genetics, philosophy, and other fields grapple with new issues of medical privacy and confidentiality brought about by recent advances in genetic research. Coverage includes topics such as genetic information in the schools, laws to regulate the use of genetic information, environmental population screening, public health lessons from the HIV experience, European data protection law, and implications of testing for health and life insurance. The book concludes with a recommendation of a framework for deciding future policy written by the editor. EPIC Publications: "The Privacy Law Sourcebook: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 1999). Price: $50. http://www.epic.org/pls/ The "Physicians Desk Reference of the privacy world." An invaluable resource for students, attorneys, researchers and journalists who need an up-to-date collection of US and International privacy law, as well as a comprehensive listing of privacy resources. ================================ "Filters and Freedom - Free Speech Perspectives on Internet Content Controls," David Sobel, editor (EPIC 1999). Price: $20. http://www.epic.org/filters&freedom/ A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression. ================================ "Cryptography and Liberty: An International Survey of Cryptography Policy" Wayne Madsen and David Banisar, editors, (EPIC 1999). Price: $15. http://www.epic.org/cryptobook99/ An international survey of encryption policies around the world. Survey results show that in the vast majority of countries, cryptography may be freely used, manufactured, and sold without restriction, with the U.S. being a notable exception. ================================ "Privacy and Human Rights 1999: An International Survey of Privacy Laws and Developments" David Banisar, Simon Davies, editors, (EPIC 1999). Price: $15. http://www.epic.org/privacy&humanrights99/ An international survey of the privacy and data protection laws found in 50 countries around the globe. This report outlines the constitutional and legal conditions of privacy protection, and summarizes important issues and events relating to privacy and surveillance. ================================ Additional titles on privacy, open government, free expression, computer security, and crypto, as well as films and DVDs can be ordered through the EPIC Bookstore: http://www.epic.org/bookstore/ =======================================================================  Upcoming Conferences and Events ======================================================================= Washington, D.C., USA Internet Engineering Task Force (IETF) Meeting. November 7-12, 1999. Omni Shoreham Hotel. Washington, D.C. For more information: http://www.ietf.org/meetings/IETF-46.html The 1999 BNA Public Policy Forum: E-Commerce and Internet Regulation. November 15, 1999. Mayflower Hotel. Washington, D.C. For more information: http://internetconference.pf.com/ Call for Papers -- Impacts of Economic Liberalization on IT Production and Use. The Information Society. Manuscripts due November 15, 1999. For more information: http://www.slis.indiana.edu/TIS Call for Papers -- Telecommunications: The Bridge to Globalization in the Information Society. International Telecommunications Society. Abstracts due November 15, 1999. For more information: http://www.its2000.org.ar PDD-63 Congressional Research Service Seminar. November 19, 1999. James Madison Building, Library of Congress. For more information: JMOTEFF@crs.loc.gov Annual Computer Security Applications Conference: Practical Solutions to Real Security Problems. December 6-10, 1999. Radisson Resort Scottsdale. Phoenix, Arizona. For more information: http://www.acsac.org/ Integrating Government with New Technologies '99 Policy vs Technology: Service Integration in the New Environments - A two-day Seminar and Training Session. December 13-14, 1999. Government Conference Center. Ottawa, Canada. For more information: http://www.rileyis.com/seminars Surveillance Expo '99. December 13-15, 1999. Doubletree Hotel. Crystal City, Virginia. For more information: http://www.rosseng.com PEN/Newman's Own Eighth Annual First Amendment Award. Nominations due December 31, 1999. For more information: http://www.pen.org RSA 2000. The ninth annual RSA Data Security Conference and Expo. January 16-20, 2000. San Jose McEnery Convention Center. San Jose, CA. For more information: http://www.rsa.com/rsa2000/ Santa Clara University Computer and High Technology Journal Symposium on Internet Privacy. February 11-12, 2000. For more information: http://www.scu.edu/techlaw/symposium Telecommunications: The Bridge to Globalization in the Information Society. Biennial Conference of the International Telecommunications Society. July 2-5, 2000. For more information: http://www.its2000.org.ar ======================================================================= Subscription Information ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. A Web-based form is available for subscribing or unsubscribing at: http://www.epic.org/alert/subscribe.html To subscribe or unsubscribe using email, send email to firstname.lastname@example.org with the subject: "subscribe" (no quotes) or "unsubscribe". Back issues are available at: http://www.epic.org/alert/ ======================================================================= About EPIC ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC is sponsored by the Fund for Constitutional Government, a non-profit organization established in 1974 to protect civil liberties and constitutional rights. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, e-mail email@example.com, http://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers. Thank you for your support. ---------------------- END EPIC Alert 6.19 ----------------------- .
Alert Home Page | EPIC Home Page