Citizen Surveillance and Personal Data Privacy

The real danger is the gradual erosion of individual liberties through the automation, integration, and interconnection of many small, separate record-keeping systems, each of which alone may seem innocuous, even benevolent, and wholly justifiable.

-----U.S. Privacy Protection Study Commission, 1977

Opportunity: This is how the personal data aggregation industry is being sold to an oblivious public.

New intelligence centers gather homeland security info

Several state and local jurisdictions have established intelligence centers to fuse terrorist threat information from multiple sources and different levels of government.

These "intelligence fusion centers" are being established to process information from the federal government as well as gather threat information from within state and local jurisdictions.

The concept of the intelligence fusion centers is a real leap forward and could open new opportunities for systems integrators, said Jeff Vining, research vice president for market research firm Gartner Inc. of Stamford, Conn.

"Intelligence fusion centers are red hot for state and local governments, which are becoming not just consumers of intelligence information but also collectors of it," he said.

Companies positioned well for this work are those that have federal defense and intelligence experience, such as EDS Corp. and Northrop Grumman Corp., homeland security experts said. Contractors with expertise in the criminal justice information-sharing arena, including Accenture Ltd., BearingPoint Inc. of McLean, Va., and Unisys Corp., also are likely to pursue opportunities.

Fose 2005 - the premier showcase conference by surveillance & data brokerage firms for government technology customers. "FOSE is the most comprehensive technology event serving the government marketplace."

The Private Sector's Role in Building the Intelligence Community of the 21st Century: Increased Partnering with Industry to Maintain America's Edge - a press release that details the new opportunities for corporations to cash in on the $40 billion intelligence industry created and fueled by the government's insatiable appetite for citizen surveillance.

HIPAA notices improve public confidence over medical information uses - A press release issued about the time the Choicepoint scandal was erupting onto the scene in an apparent attempt to pre-empt any concerns over personal data abuse.

Uses and Abuses: This is actually how it's being collected and used against you, with or without your knowledge.

Tracking US voters

(From January 2004)

Political groups are finding out what kind of car their prospective supporters drive, how much they earn, what sort of neighborhood they live in and what magazines they read.

They may not know how individuals voted in the last election, but they do know who showed up at the polls and whether they are registered with a particular party -- strong indicators of how they are likely to vote in the November election, experts say.

"It's pretty scary, the stuff you can get on people," said Robert Richman, founder of the liberal campaign consulting firm Grassroots Solutions.

[...]

On a recent afternoon, company President Dean Aristotle Phillips searched the voter database for Democratic women between 35 and 45 years old in Fairfield County, Connecticut, who have indicated they don't want to receive telemarketing calls.

The computer returned 3,004 matches, with a long list of personal details: name, address, phone number, income level, whether they have children, household size, whether they have an "ethnic" surname. Contributions to political candidates, arts organizations, environmental groups and other interest groups were also noted.

Most valuable is the voter history, which reveals how many elections the person has participated in since 1984. Reliable voters are especially prized, Phillips said.

Tracking voters in Europe with US technologies

Sophisticated data analysis techniques imported from the US will be
used for the first time in Britain in the general election expected in
May.

But data protection laws mean the political parties will have much
less freedom to exploit information about voters' personal details
than their American counterparts.

The use of consumer data as a political marketing tool is still in its
infancy in the UK, but both the main parties are studying commercially
available information as a way of targeting swing voters.

Labeling and mislabeling voters as felons

The Salon investigation of Florida's voter rolls [in 2000] revealed that many voters, perhaps thousands, lost their right to vote because their names appeared on a flaw-ridden list generated by DBT (which has tight Republican ties) that included purported "felons." The investigation revealed that the lists were used in different ways at each of the state's 67 individual county election boards. Some found the list too unreliable and didn't use it at all, but most used the file as a resource to purge names from their voter lists. A disproportionate number of the voters purged were Democrats.

See also Greg Palast's article Florida's flawed "voter-cleansing" program

Tracking foreigners for political purposes in Latin America.

Kansas seeking abortion records from clinics

Little could be more sensitive or private than patients' medical records, particularly records of a woman's pregnancy, her sexual history, birth-control practices and decision to obtain a late-term abortion.

Imagine those intimate records turned over to the government for a wide-ranging investigation headed by a prosecutor who is an ardent opponent of abortion.

That's just what will happen in Kansas, if state Attorney General Phill Kline has his way. The prosecutor is demanding the records of 90 women and girls who obtained late-term abortions at two Kansas clinics. The clinics are battling a local judge's order to turn over the records. They've asked the Kansas Supreme Court to reject or narrow the order.

DNA Discrimination Illegally testing workers for genetic defects. Admittedly this is a separate but equally relevant issue regarding the use of personal information.

The commission said the tests violated the 1990 Americans with Disabilities Act, or ADA, by subjecting the unknowing employees to DNA analyzes of whether they were genetically predisposed to carpal tunnel syndrome, a painful hand and wrist condition often caused by repetitive motion.

Related: DNA on trial - "Genetics may have opened the doors to new forms of discrimination. Is there a legal defense?"

What the future holds: Global DNA screening & Database - it creeps further under the wire without the slightest concern from Americans who are more afraid of the terrorists under their beds than they are of the government in their bloodstreams.

Everybody in Europe and the US should have their genetic fingerprints entered into an international database to enable law enforcement agencies to fight crime and terrorism in an unstable world, according to James Watson, the co-discoverer of the DNA double helix. (from link)

SC collected DNA samples at birth for six years, made samples available to research institutions without parents' knowledge or consent - article actually talks about allowing parents to opt out of state's DNA storage program. I need a better link for the discovery that this was happening, if anyone could help dig it up.

Absolute Identification - a chilling must-read in the history of biometrics and the Death of Privacy in the 21st Century.

Just purchased firestarter fluid using your Kroger Shopper Card? Better hope your house doesn't burn down soon because you're the prime suspect.

Have you recently returned an item for a refund? Then you're on a list, and flagged as a problematic customer.

School students tagged and tracked with RFID, without parental knowledge or consent.

School superintendents struck a deal with a local maker of the technology last year to test the system to track attendance and weed out trespassers.

But students and parents, who weren't told about the RFID chips until they complained, are upset over what they say are surreptitious tactics the school used to implement the program. [...]

The Players: This is a very meager collection of who is exploiting our lack of control over our own personal data, in some cases with their known recent security breaches highlighted. This is by no means a comprehensive list, and it would be nearly impossible to compile such a list since everything we do is collected, stored and accessed or sold by some stranger somewhere in this country or offshore.

Aristotle International Inc. - DC firm engaged in voter tracking worldwide (homepage). Was also involved in Ukraine's election.

Choicepoint - largest reported breach of personal data security to date (homepage)

The number of consumers whose personal information may have been disclosed to identity thieves by database firm ChoicePoint climbed from 35,000 in California to 145,000 nationwide Wednesday, according to the company.

ChoicePoint Inc., Alpharetta, GA, keeps billions of data points on businesses and nearly every adult in the United States, including names, addresses, Social Security numbers, credit reports and criminal records.

 The company's ChoicePoint Precision Marketing division maintains the MarketView database of 220 million consumers, including demographic, lifestyle, credit and financial information from multiple sources. The division also provides analytical, telemarketing, creative, e-mail append, lettershop and lead generation services to direct marketers. Other ChoicePoint divisions offer services to government and law enforcement and provide background checks for employers and insurance companies. [...]

(Note that Choicepoint is also the firm retained by NYC to identify WTC victims' remains using DNA profiles. Now conveniently and somewhat suspiciously, 1,100 victims will forever remain unidentified as the effort is cancelled.)

Embattled Data Collector a Big Homeland Security Contractor - HERE is the crux of the matter: Government is prohibited from collecting and storing information on citizens, but....

John Soma, law professor and director of the Privacy Policy Center at the University of Denver, said it was unlikely that the federal contracts would be directly affected by the ChoicePoint debacle but that data mining's growing vulnerabilities had been revealed.

Soma said private companies such as ChoicePoint can legally collect and swap many private and public records that the government cannot. Hiring ChoicePoint allows the government to sift through records it would not be able to on its own.

LexisNexis (this latest breach occurred in their subsidiary Seisint - the MATRIX company - which reportedly has some 20 billion records on file). (homepage)

LexisNexis, a worldwide provider of legal and business data, announced yesterday that information about 32,000 consumers was fraudulently gathered in a series of incidents. The data include names, addresses and Social Security and driver's license numbers.

The breaches occurred at the company's recently acquired Seisint Inc. subsidiary, a Florida firm that sells data amassed from extensive public records searches to law enforcement agencies, businesses, private investigators and others.

[...]

LexisNexis Group acquired Seisint last summer for $775 million in cash. At the time, Seisint was best known as the company behind a counter-terrorism supercomputer called the Matrix, which enabled law enforcement and intelligence authorities to blend investigative files with billions of public records.

Gratuitiously, and rather insultingly as if we need the slap in the face at just how pervasive the risks are, the Washington Post article throws in a bit about a recent credit card breach by shoe retailer DSW. More on DSW here, with cases of fraud emerging from the breach.

Acxiom Database Hacked - (homepage)

Wells Fargo bank data thought to be at risk - (homepage)

[...] "Approximately 70 percent of our remote data has some measure of security exposure as stored and managed today."

In other words, nearly three-quarters of customer info farmed out by Wells Fargo, the nation's fourth-largest bank, could be in danger of falling into the wrong hands.

Accenture Consulting firm gets $10B contract to track visitors but critics take aim at its offshore HQ and privacy concerns (homepage)

The contract for Homeland Security's border protection program, called U.S.-Visit and worth up to $10 billion over the next decade, was awarded to the U.S. subsidiary of Accenture Ltd., which is headquartered in Bermuda.
[...]
Eric Stange, Accenture's managing partner for defense and homeland security, told Newsday that the company - along with partners Raytheon Corp., Titan Corp. [of Abu Graib interrogations fame], and SRA International-will create "virtual borders" intended to identify potential terrorists entering the U.S. at about 300 sites along the Canadian and Mexican borders.

(See also Accenture wins $10bn Homeland Security gig)

HIV email list

A confidential list of 4,500 Palm Beach County residents with AIDS and 2,000 who are HIV positive, including their addresses, was inadvertently emailed to more than 800 county workers, officials said.

Westlaw's Egregious Loophole - (homepage)

The well-known legal research service Westlaw goes "out of its way to make identity theft easy" by providing access to millions of Americans' Social Security numbers, Sen. Charles Schumer (D-N.Y.) said Thursday.

(also read Schumer's press release on Westlaw's egregious loophole)

Bank of America data lost, potentially affecting 1.2 million government employees

RFIDs - to date the biggest offender is Walmart, or is it?

Loyalty shopping cards Your shopping patterns can and will be used against you.

National City Bank - personal records found in trash bin behind this Cincinnati bank.

The Law: This is but a mere snapshot of how we lost our traction on that proverbial slippery slope, with the foxes guarding the henhouse.

DHS names Gator exec to head privacy unit

Citizen Snoops Forever: The intelligence reform bill will turn car dealers into spooks, permanently

Title III of the PATRIOT Act required a broad category of businesses defined as "financial institutions" to set up anti-money laundering programs similar to those already in existence for banks. From the definitions of the PATRIOT Act and other statutes, These "financial institutions" specifically include auto dealers, jewelry stores, travel agencies, and financial service providers, as well as any other type of business the Treasury Department regulators deem to have a connection to money laundering [...]

Flashback 1997 - "encryption keys": Ashcroft pro-privacy, Kerry pro-surveillance - not a good reflection on the fickleness of our lawmakers.

Federal Trade Commission Information Privacy and Security - FTC Privacy Initiatives

Europe values citizen privacy when it comes to RFIDs, US doesn't

The resulting [EU] guidelines include gaining unambiguous consent from individuals where RFID is used and providing clear information to the so-called data subjects including the presence and location of RFID tags and trackers, what sort of data is being collected and how it is being processed. The E.U. also wants individuals to be made fully aware that they have the right to gain complete access to any personal data being collected and stored on them as well as the right to check on the accuracy of the data.

Courts not friendly to consumers

Legal experts say that people who suffered losses as a result of the breach will find it difficult to get compensation from ChoicePoint for selling their personal data to con artists, even if the victims can prove that ChoicePoint was negligent in screening customers who purchased their data. That's because courts have been unwilling to penalize companies when victims of identity theft are not their direct customers.

However, Trans Union - one of the big 3 credit reporting agencies - lost several cases in 2002, and was ordered the highest payout to date ($5.3million) for damages suffered as a result of erroneous data in consumer credit reports. TU was expected to appeal the decision.

Citizens data privacy rights groups and actions:  We're shouting it from the rooftops - is anyone listening?

Center for Democracy & Technology

Privacy Rights Clearinghouse

CASPIAN - loyalty cards and RFIDs

EFF

EPIC - Electronic Privacy Information Center

ACLU - take action on the MATRIX system (flash video); also see their Combatting the Surveillance Industrial Complex report.

Privacy Times - a subscription-only resource for Privacy and Information law and policy.

No Place to Hide

Privacy International (UK)

Selected consumer actions:

Shareholders sue Choicepoint

Specifically, the [shareholders] suit alleges that the defendants knew that ChoicePoint's measures to protect its data were inadequate, that the company knew it was selling data to illegal enterprises, that security breaches had occurred twice before and that the company had exposed more than 500,000 people to the threat of identity theft, according to the statement.

CA woman sues Choicepoint

A California woman has filed the first lawsuit against ChoicePoint for fraud and negligence in the wake of the company's recent disclosure that it sold personal information about more than 140,000 people to identity thieves.

The case could set a precedent that would help establish better standards for how data brokers secure and sell consumers' private information and lead to regulations that would hold them accountable for lax data protection.

Choicepoint under investigation for executives' stock sales

Attorney Generals from 19 states call for tighter regs on data brokers

Privacy discussion creeping into offshore data center policies - not so much action in this case, but the level of awareness regarding data privacy issues is growing, as this article demonstrates.

Senate committee on Banking, Housing, and Urban Affairs begin hearings March 10 - check cpsan.org for live coverage.

I'm still adding info to this so bear with me. Add your items and concerns to this list to make it as broad as possible without losing sight of the big picture of the danger of government and corporate surveillance of citizens.