Wired News: Fighting for Right Not to Show ID
02:00 AM Feb. 27, 2004 PT

Dudley Hiibel, a Nevada rancher who covets his privacy, didn't want to hand over his identification to a police officer in 2000. His refusal landed him in jail and his name on the U.S. Supreme Court's docket. "

Yahoo! News - Softbank Says Data on 4.52 Million Subscribers Leaked Fri Feb 27, 6:31 AM ET

TOKYO (Reuters) - Softbank Corp., Japan's largest provider of broadband Web access, on Friday said 4.52 million names, or 67 percent of its Yahoo BB Internet service database had been leaked due to two alleged extortion rings.

The company said it expected to spend four billion yen to compensate all of its 3.8 million Yahoo BB subscribers as well as other affected people. It also reiterated its recently announced goal of signing up six million subscribers by September 2005.

The database included 2.4 million current customer names as well as those who left the service, those who are still in the process of signing up, and those who are still in its free trial period.

Japanese media described it as the largest-ever leak of customer data.

"We are sincerely sorry," Softbank Chief Executive Masayoshi Son told a news conference as he bowed his head. "We will take the utmost care to make sure this never happens again."

Tokyo metropolitan police said earlier this week they had arrested four men in two separate cases on suspicion of stealing confidential customer data and trying to extort money from Softbank by threatening to leak it.

....

Son said the breach of security came from Softbank BB, the subsidiary that manages the business and of which he is also CEO.

He said names, phone numbers, postal addresses, email addresses and Yahoo Japan IDs were leaked, but credit card, bank account and password details were not involved as they were held on a different database.

In response, he said the company has severely restricted the number of employees that can access the database and improved its logging system to record access history. Son also said the company has retained a security firm to help prevent hacking from the outside.

Softbank said it believes the information was obtained from the inside, but it does not yet know specifically how the information was obtained. It is issuing 500 yen cash certificates to all Yahoo BB users, as well as other affected people, as an apology. ...

The Province - Your privacy rights get little protection from folks in Victoria

Jon Ferry
The Province - Wednesday, February 25, 2004

This Sunday is not simply a day that comes along once every four years. It is, I'm told, the 100th anniversary of the first vehicle registration in B.C.

Despite repeated attempts, however, I've been unable to get hold of B.C.'s $175,000-a-year privacy commissioner, David Loukidelis, to ask him why his office lets ICBC sell your licence- plate information -- at $5 or $6 a pop -- to Impark and 13 other parking-lot operators.

I also wanted to ask him whether he approves of this practice -- which many of you clearly don't. "I just finished reading your article on ICBC's selling of our personal data to private parking lot firms," writes Levan Turner of Victoria. "And I must say I am HORRIFIED!!!!"

But Mary Carlson, a director in Loukidelis's office in Victoria, told me her boss was in Santiago, Chile, on a U.S.-government-sponsored trip. And, while I was sad not to reach Loukidelis, I was glad to find we don't have a budding Radwanski here -- and that it's the freedom-of-information-loving U.S. taxpayers who'll be footing his travel bill.

Carlson, meanwhile, defends ICBC's legal right to sell your plate information. She argues that, under B.C.'s privacy laws, "public bodies can use or disclose information for the same reason it was collected in the first place." She notes that at least part of the info ICBC collects from you is needed for managing the highway system -- and that, under B.C. motor vehicle law, parking lots are part of that system. So, for that matter, is "every private place or passageway to which the public, for the purpose of the parking or servicing of vehicles, has access or is invited." In other words, it includes everything from your local muffler shop to the back yard parking lots beside the PNE.

Now, I think a good lawyer, paid handsomely, could drive a truck through Carlson's argument. I mean, the reason parking lot operators need your plate info is NOT to manage our highways. It's to make more money for themselves -- and make up for deficiencies in the management of their lots.

And you have to question the morality of a government monopoly like ICBC selling the info it requires from you, to assist in doubtful private debt collection. I don't buy ICBC's argument that it's required to so by law. Unfortunately, Nick Geer, ICBC's $300,000-a-year CEO, was unavailable for comment yesterday.

B.C.'s milquetoast privacy-protection system needs a shakeup. And I'd be happy to get Uncle Sam to fly me to the land of South America's finest wines to speed the process.

In the meantime, have a happy 100th vehicle- registration anniversary. And don't forget to contact your MLA to get him or her to stand up for your privacy rights. As things stand, there's obviously little protection for them in Victoria.

Letters: provletters@png.canwest.com. Voice mail: 604-605-2603 E-mail: jferry@png.canwest.com.

© The Vancouver Province 2004

Computerworld | Privacy Commission urges employee records review: "Privacy Commission urges employee records review
Sandra Rossi, Computerworld

24/02/2004 13:20:35

Federal Privacy Commissioner Malcolm Crompton has released a discussion paper on information privacy and employee records that will have widespread implications for the IT department.

Crompton said the paper, jointly prepared by the Attorney General's department and Department of Employment and Workplace Relations, will raise debate about the need to protect employee records, which are not covered by the current Privacy Act.

Since 21 December 2001, he said, the Office has received 2140 phone enquiries (around 3.4 percent of total calls) about the employee records exemption.

"During that time we have had to decline 45 complaints because of the employee records exemption," Crompton said.

"Employee records often contain sensitive information such as sick leave and wage records and it is important that we get the privacy balance right in this area.

"The Office will examine the paper closely and will make a submission on the discussion paper; I strongly encourage everybody with an interest in this area to do the same."

The Government announced in November 2000, before the private sector amendments to the Privacy Act were finally passed by Parliament, that it would review existing Commonwealth, State and Territory Laws to consider the extent of the privacy protection for employee records and whether there was a need for further measures.

At that time the government expressed the view that while employee records are deserving of privacy protection, such protection is more properly a matter for workplace relations legislation.

Submissions close on April 16 and any changes to the legislation will have implications for business processes and how records are maintained by the IT department. - with Staff Writers

The Trouble with RFID | Posted February 3, 2004
by Simson L. Garfinkel

RFID is such a potentially dangerous technology because RFID chips can be embedded into products and clothing and covertly read without our knowledge. A small tag embedded into the heel of a shoe or the inseam of a leather jacket for inventory control could be activated every time the customer entered or left the store where the item was bought; that tag could also be read by any other business or government agency that has installed a compatible reader. Unlike today's antitheft tags, every RFID chip has a unique serial number. This means that stores could track each customer's comings and goings. Those readers could also register the RFID tags that we're already carrying in our car keys and the "prox cards" that some office buildings use instead of keys.

The problem here is that RFID tags can be read through your wallet, handbag, or clothing. It's not hard to build a system that automatically reads the proximity cards, the keychain RFID "immobilizer" chips, or other RFID-enabled devices of every person who enters a store. A store could build a list of every window shopper or person who walks through the front door by reading these tags and then looking up their owners' identities in a centralized database. No such database exists today, but one could easily be built.

Indeed, such warnings might once have been dismissed as mere fear-mongering. But in today's post-9/11 world, in which the US government has already announced its plans to fingerprint and photograph foreign visitors to our country, RFID sounds like a technology that could easily be seized upon by the Homeland Security Department in the so-called "war on terrorism." But such a system wouldn't just track suspected Al Qaeda terrorists: it would necessarily track everybody--at least potentially.

Bank ATMs Converted to Steal IDs of Bank Customers

"A team of organized criminals is installing equipment on legitimate bank ATMs in at least 2 regions to steal both the ATM card number and the PIN. The team sits nearby in a car receiving the information transmitted wirelessly over weekends and evenings from equipment they install on the front of the ATM (see photos). If you see an attachment like this, do not use the ATM and report it immediately to the bank using the 800 number or phone on the front of the ATM."

Wired News: Great Taste, Less Privacy

By Kim Zetter - 02:00 AM Feb. 06, 2004 PT

A patron walks into a bar and orders a drink. The bartender asks to see some ID. Without asking permission, the barkeep swipes the driver's license through a card reader and the device flashes a green light approving the order.

The bartender is just verifying the card isn't a fake, right? Yes, and perhaps more.

Visitors to an art exhibit at the Pittsburgh Center for the Arts got more than their martinis when they ordered drinks at a bar inside the gallery's entrance. Instead of pretzels and peanuts, they were handed a receipt containing the personal data found on their license, plus all the information that could be gleaned from commercial data-mining services and voter registration databases like Aristotle. Some patrons also got receipts listing their phone number, income range, marital status, housing value and profession. For added effect, the receipt included a little map showing the location of their residence. "

4.1.3 - An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.

This should mean that the oursourcer remains responsible for everything that happens to the data, including the obligation to safeguard the data. This responsibility can't be handed off.]

Last year a medical transcriber in Pakistan threatened to post patients' medical records online unless the University of California at San Francisco Medical Center settled a financial dispute. Lubna Baloch, the transcriber, claimed she hadn't been paid the 3 cents a line reportedly promised by a Texas man, who, in turn, had subcontracted the work from a Florida woman. The Florida woman herself had subcontracted the work from Transcription Stat, a firm in Sausalito, California, that was paid 18 cents a line by the medical center for the work. The owner of Transcription Stat said she couldn't respond to questions due to a pending lawsuit in the case.

A hospital spokeswoman said the medical center didn't know or approve of more than one level of subcontracting and was not aware that work was being sent outside the country.

Although the Health Insurance Portability and Accountability Act of 1996 requires medical transcribers in the United States to uphold privacy practices mandated in the bill, the federal law has no reach overseas.

Of course, overseas workers aren't more likely to compromise or misuse sensitive information than workers in the United States. For example, recently, U.S. publications published false rumors that actress Nicole Kidman might be suffering from breast cancer after someone leaked information about her breast exam to reporters.

In addition to sensitive medical data, information shipped to foreign workers can include bank account numbers, Social Security numbers, stock holdings and credit card numbers -- all valuable information to identity thieves.

Story by Jaikumar Vijayan

FEBRUARY 20, 2004 ( COMPUTERWORLD ) - WASHINGTON -- Outsourcing jobs to offshore destinations can sharply increase data privacy risks and the complexity of managing that risk, several experts at the Fourth Annual Privacy and Data Security Summit here warned this week.

As a result, companies need to ensure that overseas vendors are contractually tied to specific conditions regarding how data is transmitted, accessed, used, stored and shared, they said. Those challenges include regulatory compliance, data protection and access issues, as well as monitoring and auditing issues.

"The risks are enormous to business strategy," said Richard Purcell, founder of Nordland, Wash.-based consultancy Corporate Privacy Group and former chief privacy officer at Microsoft Corp.

By Diane Strandberg
The Tri-City News

Files containing property tax information and receipts for parking tickets and business licences were mistakenly left overnight Thursday in a recycling bin outside Port Coquitlam city hall. But the papers were public documents and were picked up and stored for shredding after they were noticed by city clerk Susan Rauh.

Rauh said the documents were from a year-end office clean up and shouldn't have been dumped. 'They were supposed to be shredded,' said Rauh, who said staff have been made aware of the problem and told to be more careful.

The city doesn't have any formal policy on document disposal but will have when it completes its business plan, which will include information on record management, said Kathleen Vincent, the city's manager of communications and administrative services.

But the city does keep up-to-date with privacy laws, including a new Personal Information Protection Act.

The documents, some dated as recently as last October, show assessed property values and what property taxes, garbage and sewer and water fees are owing as well as whether accounts are overdrawn. "

"Premier Ralph Klein's government should tighten up its use of personal information to prevent abuse, says the office of Alberta's privacy commissioner and opposition critics. Those calls came after the province revoked parking lot operator Impark's access to personal information after a company contractor violated privacy rules by making bill collecting calls late at night.

The province received recommendations six years ago from the privacy commissioner and auditor general that it be more up-front with the use of personal information, said a spokesman for Alberta Privacy Commissioner Frank Work.

'It was to have strong (bill) collection-use disclosure to protect personal information and to prevent misuse,' said Tim Chander, adding the province has adopted many of its proposals.

'We think they should go "

Privacy watchdog highlights website flaws. 12/02/2004. ABC News Online: "Privacy watchdog highlights website flaws

The [Australian] Federal Privacy Commissioner believes many Australian companies are risking significant damage to their brands because of fundamental errors on their websites.

A recent investigation into Melbourne-based Ticketmaster 7 found the organisation's website allowed customers' personal information and contact details to be easily accessed by visitors to the site.

Privacy Commissioner Malcolm Crompton says he has highlighted Ticketmaster 7 to ensure other companies meet their obligations under the privacy act.

'It's not on any more for any company in Australia to have such simple flaws in their websites and one of the purposes of making this one so public is to call on all companies in Australia to assure themselves that they aren't exposed to this risk, which includes the risk of significant brand damage,' he said."

ITBusiness.ca: "For the last 10 years, countless cases of identity theft have sprung up across North America because industry standards for customer privacy protection have been 'inadequate,' said a co-author of Ottawa�s electronic privacy act Wednesday.

'I express indignation that it has taken so long to address the issue (of identity theft) and I blame government and industry,' said Stephanie Perrin, one of the authors of the Personal Information Protection and Electronic Documents Act (PIPEDA) and the president of Montreal-based Digital Discretion Inc.

Perrin was one of several panelists who spoke at an Ottawa conference entitled 'Identity Theft: A $5 Billion Speck on Canada's Radar Screen.' Another panelist charged that there are 'very poor government and business security practices' for handling personal information. "

The Australian Consumers Association has called for a Federal Government inquiry into the credit-reporting system after a survey published today in its magazine Choice found 34 per cent of files held by the main bureau contained mistakes.

Choice asked 58 readers to request a credit report from Baycorp, which holds 13 million individual files.

Most errors (84 per cent) were in personal details such as name, licence number or address. The consumer association said this exposed consumers to the risk of 'mismatching' - with the system giving out data on the wrong person.

...

The federal privacy commissioner had admitted a six-month backlog of complaints, and did not have the resources to deal with credit-reporting problems, she said."

"TiVo watchers uneasy after post-Super Bowl reports
By Ben Charny
Staff Writer, CNET News.com
http://news.com.com/2100-1041-5154219.html

Janet Jackson's Super Bowl flash dance was shocking in more ways than one: Some TiVo users say the event brought home the realization that their beloved digital video recorders are watching them, too.

...

What's new:
TiVo-related privacy concerns resurfaced this week after Janet Jackson's Super Bowl flash dance prompted the maker of the digital video recorder to show off that it can tell what viewers are watching.

Bottom line:
Although TiVo has always disclosed its data-gathering practices, the new wave of complaints may indicate that it still has work to do to convince customers that it's protecting their interests.

CBC North | News | Yukon government warns "clients" of security breach: "WHITEHORSE - Yukon government officials are writing letters to hundreds of criminals to let them know their probation files have been stolen.

Their files were stored on some computers that were stolen from government offices over the weekend.

However, the territory's deputy minister of Justice believes computer hardware, and not personal files were the real target.

And he says the government is confident that even though the files are now in criminal hands, people's personal information is still secure."

ITBusiness.ca: Electronic health records: Condition critical: "But an EHR, useful as it may be, does not come without headaches of its own, observed Richard Shekter, a medical malpractice lawyer with Shekter Dychtenberg.

'The real issue is while the justification for enhancing patient care (through EHR) is unassailable, the means by which you have to work to protect yourself and the rights of your patients gets immeasurably complicated,' he said.

That's because health-care organizations, like the private sector, are now governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA), he said, a piece of legislation which was never designed to meet the needs of the medical community.

And although students in the health care sciences might think confidentiality is the hallmark of the health care system, he said, 'I'm here to tell you that is largely a myth.

'I can tell you as a lawyer practising in the health field every day I am reading the health records of 10-20 patients I�ve never met. I get automatic access to the health records of the doctor who may or may not have seen thousands of patients over a 10-15 year period.'"

Chris writes 'The Swipe Toolkit is a collection of web-based tools that sheds light on personal data collection and usage practices in the United States. The tools demonstrate the value of personal information on the open market and enable people to access information encoded on a driver's license or stored in some of the many commercial data warehouses. Check out the Data Calculator, which shows how much your personal info is worth, and how the data brokers get it. It's all part of the Swipe Project, which will be on exhibition at UC-Irvine in March.' "

"Police ask for public's help in solving theft

by Sarah Elizabeth Brown

Whitehorse RCMP are turning to the public for help in solving a computer theft from the territory's probation office.

In particular, police are asking for calls from anyone who saw vehicles or people in the alley between Jarvis Street and Wood Street behind the Yukon Theatre between 4 p.m. and midnight last Sunday.

Police are also asking that anyone who noted activity in front of the Justice department's offices at 301 Jarvis St. in that time period to call them or Crime Stoppers.

Taken during the theft was a shopping list of electronics: palm pilots, camcorders, overhead projects, miscellaneous computer accessories, several black Dell computers and several laptop computers of the same make.

Along with the cost of the equipment itself, the concern is what information was stored on the hard drives.

The office's main server where the bulk of information is kept are located outside the building.

Justice Minister Elaine Taylor told reporters this morning that department officials and police are still trying to determine what information was on the hard drives of computers and laptops now missing.

If personal information was taken, those individuals will be notified immediately, said Taylor.

Most of the stolen equipment was taken from the adult probation office on the second floor, along with the crime prevention and policing and assistant deputy minister's office, also on the second floor, a department spokeswoman explained today.

While a boardroom on the first floor was entered, victims' services and the family violence sections were untouched and secure on the first floor.

Anonymous tips can be made to Crime Stoppers at 1-800-222-8477. Whitehorse RCMP can be contacted at 667-5555."

1. PIPED Act Case Summary #228: A transportation company disclosed an employee's personal information without consent
2. PIPED Act Case Summary #227: Company did not record phone conversation and give transcript to the police
3. PIPED Act Case Summary #226: Company's collection of medical information unnecessary; safeguards are inappropriate
4. PIPED Act Case Summary #225: Telecommunications company disclosed customer's personal information
5. PIPED Act Case Summary #224: Bank failed to correct credit rating discrepancy and to provide access to financial records

"If you are headed to your dentist's office, pharmacy or travel agency, you may be asked to sign a form before you can get service, now that new federal privacy laws are in place.

And in some cases, you may not be able to book an appointment for a family member or have someone pick up a prescription for you without specific permission. The new privacy laws are altering the way many businesses � from pharmacies to dentists, travel agents and even the much-maligned 407 toll road � do business.

'The new law means you just can't go and collect information about people willy-nilly,' says Irwin Fefergrad, registrar with the Royal College of Dental Surgeons of Ontario.

Consumers must now be told what information is collected about them, how it is used and why it is collected. Every operation, large and small, from video stores and magazine publishers to charities and accounting firms, will need to get its information management practices in order if it wants to avoid possible court action and fines, in some cases of $10,000. Consent may be written, verbal or implied � meaning that, by using a service, a person consents. However, the person must be given a chance to opt out.

Fefergrad says that will definitely mean some changes in wording and protocols. 'You can't leave personal information on voice mail, for example.' He says people may not be able to make some dental appointments for a family member without their written permission. But he notes dentists already have strong confidentiality rules."

"Some Internet experts have long suggested that the rising tide of junk e-mail, or spam, would turn into a trickle if senders had to pay even as little as a penny for each message they sent. Such an amount might be minor for legitimate commerce and communications, but it could destroy businesses that send a million offers in hopes that 10 people will respond. The idea has been dismissed both as impractical and against the free spirit of the Internet.

Now, though, the idea of e-mail postage is getting a second look from the owners of the two largest e-mail systems in the world, Microsoft and Yahoo.

Ten days ago, Bill Gates, Microsoft's chairman, told the World Economic Forum in Davos, Switzerland, that spam would not be a problem in two years, in part because of systems that would require people to pay money to send e-mail. Yahoo, meanwhile, is quietly evaluating an e-mail postage plan being developed by Goodmail, a Silicon Valley start-up company."

Report Documents Extensive Security Flaws in State Motor Vehicle Offices Nationwide

The Center for Democracy and Technology investigated problems of ID theft and fraud at state motor vehicle administration offices nationwide. They conclude, in the report referenced below, that driver license information is subject to widespread theft due to fraud and bribery, and recommend remedies to address the widespread availability of false licenses that compromise individual and national security.

Unlicensed Fraud: How bribery and lax security at state motor vehicle offices nationwide lead to identity theft and illegal driver's licenses.

28. Every person who knowingly contravenes subsection 8(8) or 27.1(1) or who obstructs the Commissioner or the Commissioner's delegate in the investigation of a complaint or in conducting an audit is guilty of

(a) an offence punishable on summary conviction and liable to a fine not exceeding $10,000; or

(b) an indictable offence and liable to a fine not exceeding $100,000.

The costs associated with privacy protection have long been a source of considerable debate. Ann Cavoukian, Ontario's Privacy Commissioner, who together with the Toronto Star's Tyler Hamilton wrote The Privacy Payoff, maintains that good privacy practices are actually good for business.

In my column of January 19, I argued maintaining a federal privacy law was essential since the provincial mish-mash of laws that would fill the void would create uncertainty and costs for the business and privacy communities.

Some remain unconvinced, however, as Professor Richard Owens illustrates in his response that accompanies this article. Far from a business opportunity, Owens writes that the federal government's Personal Information Protection and Electronic Documents Act (PIPEDA) is a costly endeavour that "rob[s] businesses and shareholders of value for no good reason, but for the legislators' inattentiveness.''

While perhaps Owens and I can agree to disagree on PIPEDA's cost implications, his response to my column makes historical claims that demand further discussion.

Consumer Federation of California - Feature Issue: "Consumer Federation of California Launches New Privacy Initiative

The Consumer Federation of California is working to qualify a new financial privacy initiative for the November ballot.

The initiative establishes the 'Ask Me First' rule - No commercial sharing of confidential financial information unless the consumer gives approval first. The initiative also stops the sale of our Social Security Numbers and increases penalties for unauthorized information sharing that results in identity theft."

As a result, all Nashville schools have stopped posting honor rolls, and some are also considering a ban on hanging good work in the hallways ... all at the advice of school lawyers.

After a few parents complained their children might be ridiculed for not making the list, Nashville school system lawyers warned that state privacy laws forbid releasing any academic information, good or bad, without permission. "