You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

EPIC Alert 24.13

EPIC Alert logo

EPIC Alert 24.13 - July 17, 2017

  1. EPIC Lawsuit Blocks Commission Attempt to Gather State Voter Data
  2. EPIC Obtains Privacy Procedures for IRS Private Debt Collection
  3. EPIC, Coalition Urge Nations to Defend Strong Encryption
  4. Congress Defends Power of Local Authorities to Regulate Drone Privacy
  5. EPIC Urges TSA to Consider Alternative to Biometric Collection
  6. News in Brief
  7. Chronology of EPIC v. Commission
  8. EPIC in the News
  9. EPIC Bookstore
  10. Upcoming Conferences and Events

1. EPIC Lawsuit Blocks Commission Attempt to Gather State Voter Data

The President's Election Commission, the federal agency that is seeking the state records of every registered voter in the country, announced that it would suspend the collection of personal voter data in response to a lawsuit filed by EPIC. A federal district court in Washington, DC, is now considering EPIC's motion to block the Commission's transfer of personal voter data indefinitely.

EPIC filed suit against the Commission--the first such lawsuit in the country--five days after Commission's June 28 demand letter to state election officials. EPIC also asked the court to enter an emergency restraining order against the Commission. As EPIC explained, the Commission failed to produce and publish a Privacy Impact Assessment as required by federal law before collecting personal data. The Commission's plan to amass detailed voter histories also violated the constitutional right to information privacy

After the Commission responded to the suit, EPIC told the Court that the Commission had "conceded the obvious: the privacy implications of this unprecedented demand for voter roll data from across the country are staggering." Members of the EPIC Advisory Board, experts in computer technology, contributed affidavits that underscored the vulnerabilities of the Commission's plan to aggregate personal voter data. A hearing was held before Judge Colleen Kollar-Kotelly on July 7.

On July 10, the Commission announced that it would halt its collection of voter records in response to EPIC's suit and abandon its plan to use an insecure Department of Defense website that is not approved for storing the public's personal data. Instead, the Commission said it would use an unidentified and unvetted White House computer system for stockpiling voter data. But as EPIC explained, "The Commission may not play 'hide the ball' with the nation's voter records. With such vast demands for personal information come commensurate responsibilities to provide security and privacy, and to comply with all legal obligations. Surely that is fundamental for an organization charged with promoting 'election integrity.'"

After the court requested additional briefing in the case, EPIC moved for a preliminary injunction against the Commission's voter data collection. EPIC told the court that "the threat to voter privacy and democratic institutions remains. The Commission intends to move forward, pending this Court's determination. It has established a new server within the White House to receive the voter data. It has advised state election officials that further communications regarding this undertaking are forthcoming." A response from the Commission is due July 17.

EPIC has challenged the Commission's collection of voter data on other fronts as well. EPIC's lawsuit followed a letter from 50 voting experts and 20 privacy organizations urging state election officials to oppose the Commission's demand. And EPIC has submitted urgent FOIA requests to the General Services Administration, the Election Commission, and the Arkansas Secretary of State for information about the State of Arkansas's production of voter data to the federal Commission.

The Commission is scheduled to hold its first public meeting on July 19, in Washington, DC. The case is EPIC v. Commission, No. 17-1320 (D.D.C. filed July 3, 2017).

2. EPIC Obtains Privacy Procedures for IRS Private Debt Collection

As the result of a Freedom of Information Act request to the IRS, EPIC has obtained hundreds of documents detailing procedures that bind private debt collectors dealing with U.S. taxpayers.

Following a Congressional mandate, the IRS outsourced debt collection for some U.S. taxpayers to private debt collection agencies. Transfer of personal and financial data to private entities raises data security and privacy concerns, and also makes scams and threatening phone collection tactics easier to perpetrate. A group of U.S. senators has already accused one of the four companies of engaging in abusive and illegal phone contacts.

The documents obtained by EPIC show how the IRS monitors the companies and the procedures companies must follow when contacting taxpayers. EPIC also obtained the privacy and data security requirements imposed on the debt collectors, details of how they must handle complaints, and the IRS contracts. These procedures include requirements for companies to encrypt sensitive information protected by the Privacy Act, and to purge that information when it is no longer necessary to the contractor's obligations.

In FOIA lawsuit EPIC v. IRS, EPIC is also seeking the release of President Trump's Tax records from the agency. For more information about EPIC's latest open government work, visit: https://epic.org/open_gov/.

3. EPIC, Coalition Urge Nations to Defend Strong Encryption

EPIC and over 60 organizations urged the governments of Australia, Canada, New Zealand, the United Kingdom, and the United States to respect and defend strong encryption.

These five nations, which make up a surveillance partnership of intelligence agencies, met recently to discuss national security and the "challenge of encryption." The meetings were "expected to focus on how to force tech companies to introduce back-doors." Australian officials said in advance of the meeting that they would push for "the involvement of industry in thwarting the encryption of terrorist messaging." Law enforcement officials in the US and UK have also publicly sought encryption backdoors for law enforcement.

The Coalition letter called for the rejection of "policies that would prevent or undermine the use of strong encryption." "Attempts to engineer 'backdoors' or other deliberate weaknesses into commercially available encryption software . . . are both shortsighted and counterproductive," the Coalition wrote. The Coalition explained that criminals would simply use black market tools while law-abiding citizens, companies, and government agencies would "be exposed to needless risk." The Coalition added that "government entities around the world . . . have started to recognize the benefits of encryption and the futility of mandates that would undermine it."

EPIC has advocated for strong encryption since its founding in 1994 and published the first comprehensive survey of encryption use around the world. Last year, EPIC filed an amicus brief in Apple v. FBI in support of encryption. EPIC also maintains a page on Privacy and Public Opinion.

4. Congress Defends Power of Local Authorities to Regulate Drone Privacy

The Senate and House are considering bi-partisan drone bills to protect the ability of states and local government to safeguard privacy.

The House's Drone Innovation Act, introduced by Rep. Jason Lewis (R-MN), and the Senate's Drone Federalism Act, introduced by Sen. Diane Feinstein (D-CA), would ensure that FAA regulations do not preempt legitimate interests of local governments to protect personal privacy. The bills would give State, local, and Tribal governments authority to place "reasonable" restrictions over small drones within their boundaries at up to 200 feet.

Earlier this year, EPIC submitted a statement to the House Transportation Committee and a statement to the Senate Commerce Committee to emphasize the unique privacy risks of drones. EPIC explained that although "strong drone privacy rules are vital for the safe integration of commercial drones in the National Air Space," the FAA has failed to establish necessary privacy safeguards and that the states must be free to protect privacy interests.

In a lawsuit filed last year, EPIC is challenging the FAA's failure to establish drone privacy regulations after Congress ordered the FAA to issue "comprehensive" rules for drone use. EPIC and more than 100 organizations and experts had urged the FAA to establish privacy protections prior to permitting widespread drone deployment. The FAA denied EPIC's petition and issued final rules that did not include privacy safeguards. EPIC's case, which is before a federal appeals court in Washington, D.C., is expected to go to oral argument later this year.

5. EPIC Urges TSA to Consider Alternative to Biometric Collection

In comments to the Transportation Security Administration (TSA), EPIC urged the agency to consider alternatives to expanding the collection of biometric identifiers for its Pre-Check system.

The TSA recently proposed adding further biometric information, such as iris scans, to the Pre-Check application process. The agency said that it wants to use the increased biometric collection to allow iris scans to be used in place of boarding passes for Pre-Check travelers at airport security checkpoints. The TSA keeps information obtained in the Pre-Check application process in Next Generation Identification (NGI) for 75 years and in the Automated Biometric System (IDENT) databases for 110 years or seven years after the data subject's death.

In its comments to the TSA, EPIC explained that government databases have shown themselves to be incredibly vulnerable in recent years. "The extensive storage of biometrics increases the risk of harm posed by these security breaches," EPIC wrote. EPIC also noted of the potential for "mission creep," writing that "given the increasing scope and use of these databases, no one can be sure of how their information will be used in the future." EPIC urged the TSA to "consider alternative means to the biometric information collected to conduct security threat assessments for the Pre-Check program."

EPIC routinely highlights the risks of large, overbroad government databases and the privacy risks inherent in the collection of biometric information. EPIC recently sent a letter to the House Committee on Oversight concerning the NGI program and iled a FOIA lawsuit against the FBI for information about the agency's plans to transfer biometric data to the Department of Defense.

News in Brief

EPIC Raises Questions About FBI Surveillance Programs

In a statement to Congress, EPIC told members of the Senate Judiciary Committee to press the nominee for FBI Director, Christopher Wray, on his views of FBI databases and domestic surveillance programs. EPIC again expressed concern about the size and scope of the FBI's Next Generation Identification system which stores personal and biometric information on millions of individuals. EPIC also expressed concern over the FBI's failure to issue timely privacy impact assessments, lack of transparency on drone use, and plans to monitor social media. EPIC urged the Committee to obtain the nominee's views on these matters and to ensure his commitment to protect privacy and ensure transparency at the FBI.

Appeals Court Considers Case that Aligns Privacy and FOI

The Ninth Circuit U.S. Court of Appeals heard oral arguments today in an open government case with implications for informational privacy. A group of anonymous medical employees challenged the release of personal information sought under a state public records act. EPIC filed a "friend-of-the-court" brief in the case arguing that withholding personal information is consistent with open government and constitutionally required. "Open government laws and privacy laws are complimentary: the aim is to maximize both the public's access to information about the government and to safeguard personal privacy to the greatest extent feasible," EPIC wrote. EPIC has argued for similar privacy protections in ATF v. Chicago, Chicago Tribune v. University of Illinois, Ostergren v. Cuccinelli, NASA v. Nelson, and FCC v. AT&T.

EPIC Backs Privacy Act Protections for "Insider Threat" Database

EPIC has sent comments to the Department of Justice criticizing a proposed "insider threat" database. This database replaces a similar database that was proposed and later rescinded by the FBI last fall and would allow the DOJ to collect virtually unlimited amounts of personal data from employees, contractors, interns, and visitors to DOJ facilities. Citing the size and scope of the database combined with recent government data breaches, EPIC warned that the database was putting federal employees and contractors at risk. EPIC has consistently warned against inaccurate, insecure, and overbroad government databases.

EPIC Provides Suggestions for "Self-Driving" Vehicle Legislation

EPIC has sent a statement to Congress ahead of a hearing to discuss proposed self-driving vehicle legislation. The House Energy & Commerce Committee drafted several bills related to the development and deployment of "self-driving" vehicles. EPIC urged the Committee not to pre-empt states from issuing their own self-driving vehicle regulations, to encourage developers to be transparent in the development of autonomous vehicles, and to urge that advocacy groups be included in connected car advisory councils. EPIC has been a leading advocate for privacy and safety in the development of connected and autonomous vehicle and has participated in workshops, written to NHTSA, and actively informed Congress of privacy and safety related developments in connected and autonomous vehicles.

EPIC Urges the FCC To Take Steps To Eliminate Robocalls

In comments to the FCC, EPIC has proposed that telephone service providers take steps to block unlawful robocalls. The FCC is considering a new rule that would allow phone companies to block calls from numbers they know are invalid, such as numbers that have not been assigned to a subscriber. Illegal robocalls cause substantial harm to consumers and often result in identity theft and financial fraud. EPIC supports robust telephone privacy protections and recently filed an amicus brief in support of the FCC's 2015 order that strengthened consumer protections under the TCPA.

Chronology of EPIC v. Commission

EPIC in the News

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security