Privacy News Highlights

11—17 November 2006

Contents:

CA – Biometric ID Cards Coming for Airport Workers. 2

CA – Biometrics May Help Insurance Companies Reduce Fraud. 2

CA – Winnipeg Dentist Fingerprints Patients. 2

CA – Federal Privacy Legislation Reviewed. 2

CA – Nova Scotia Protection of Privacy Legislation Proclaimed. 2

CA – Nearly Half of Canadians Find Security Laws Intrusive: Study. 2

NZ – New Zealand E-Government Strategy Released. 3

WW – Spam Levels Up Sharply in Month, Researchers Report 3

WW – Average Phishing “Catch” Soars, Survey Reports. 3

CA – Health Canada: Most Canadians Support Electronic Medical Files. 3

AU – Australia Defence Opts to Encrypt Laptop Data. 3

EU – Information Chief Embarks on Education Campaign. 4

WW – Survey: Privacy, Data Protection Top List for the First Time in 9 Years. 4

UK – More Than 33.5 Million Camera Phones in Britain. 4

WW – 20% of the World’s CCTV Cams in Britain. 4

WW – Discussion During IGF Against Internet Content Control 4

WW – Internet Censorship Growing Worldwide: Survey. 4

US – DOJ Study: 1% of Web Have Sex Content 5

WW – Phishing Up; Bank Fraud Up, but Debit and Credit Card Losses Down. 5

AU – Citibank eMail Looked Like Phish. 5

WW – DNA Fingerprinting Sparks Fresh Worries. 5

US – Massachusetts State Requires Doctors to Identify HIV Patients. 5

US – Survey: Federal IT Officials Worry Most About Security Breaches. 6

US – Survey: 49 Million US Adults (1/5) Received Data Breach Notifications. 6

EU – Germany Gives the Green Light to Citizen Identity Number 6

UK – UK Government Pushes Ahead on ID Card. 6

US – ID Theft Insurance Growing Trend. 6

US – Ping Identity Announces Digital Identity System for US Gov’t Agencies. 6

EU – EC Threatens Microsoft With Further Fines. 7

WW – Internet Explorer to Indicate Legitimate Websites. 7

OECD – Cross-Border Privacy Law Enforcement 7

WW – E&Y Survey: Many Firms Do Not Manage Risks of Third-Party Data Sharing. 7

WW – Google CEO Speaks Out on Government Efforts to Obtain Users’ Search Queries. 7

US – ACLU Says Wiretapping Program Not Constitutional 8

US – HP’s Dunn Pleads Not Guilty to ID theft 8

US – Opinion: Higher Ed Should Improve Privacy Performance. 8

US – Pharmaceutical RFID Pilots Finds Promise, Problems. 8

CA – BC Firm Pushing RFID for License Plates. 8

CA – Ottawa Professor: Implantable Chips Require More Discussion in Canada. 9

US – Survey: Business Leaders Don’t Trust Their Own Security. 9

US – Information Security Handbook: A Guide for Managers. 9

AU – Australian Privacy Group Pans Access Card. 9

US – HSPD-12 Cards Open to Function Creep. 9

CA – Ottawa Boosts Funding to Transit Surveillance. 10

US – California Car Rental Firm Settles With Prosecutors. 10

US – Cell Phone Companies See Promise in Location-Based Services. 10

US – Feds Make Progress with Fund for ChoicePoint Victims (But Barely) 10

US – New Congress Breathes New Life Into Efforts To Pass ID Theft, Pretexting Bills. 11

US – Republicans Propose Last-Minute Spy Bill 11

 


 

CA – Biometric ID Cards Coming for Airport Workers

The federal government will introduce biometric ID cards for workers at 29 major airports by the end of the year, Transport Minister Lawrence Cannon said last week. The cards are aimed at improving airport security by allowing scanners to check two unique human characteristics - fingerprints and iris patterns. The government is moving on a two-year-old test, which began operational trials at airports in Vancouver and Kelowna, B.C., in October 2004. [Source]

 

CA – Biometrics May Help Insurance Companies Reduce Fraud

A Toronto company is touting its voice biometric technology as one way to help insurance companies detect and prevent fraud. The technology could be used in call centers to help employees authenticate callers. The software is about 70% accurate, according to the company’s CEO. [Source]

 

CA – Winnipeg Dentist Fingerprints Patients

A privacy attorney has raised concerns about a Winnipeg dentist’s practice of using fingerprints to announce the arrival of patients. The patients do not need to check in with a receptionist after touching their fingers to a biometric pad that collects their information and alerts the staff. The system is voluntary. However, the privacy attorney said the practice could potentially violate privacy laws. [Source]

 

CA – Federal Privacy Legislation Reviewed

The House of Commons standing committee on access to information, privacy and ethics meets Monday with Industry Canada officials to be briefed on the Personal Information Protection and Electronic Documents Act (PIPEDA). It is the first step by the committee in what is anticipated to be a substantial review of the legislation enacted in 2002 to give consumers greater rights over how their personal information is collected, used, retained and disclosed in the course of commercial activity. [Source]

 

CA – Nova Scotia Protection of Privacy Legislation Proclaimed

Legislation to ensure that Nova Scotians’ personal information is not disclosed under the U.S. Patriot Act was proclaimed on Nov. 15. The new Personal Information International Disclosure Protection Act outlines a series of requirements and penalties that protect personal information from inappropriate disclosure. Said Justice Minister Murray Scott: “The act outlines the responsibilities of public bodies, municipalities and service providers and the consequences if these responsibilities are not fulfilled.” [Source]

 

 

CA – Nearly Half of Canadians Find Security Laws Intrusive: Study

Americans are more likely than Canadians to be concerned about the intrusiveness of new laws aimed at protecting national security in the wake of the Sept. 11, 2001, attacks, new Canadian research suggests. In what is believed to be the first cross-cultural study of its kind, Queen’s University researchers surveyed 9,000 people around the world about their experiences with surveillance and privacy. The study was released Monday. 57% of Americans and 47% of Canadians said that these [post-9/11 laws] are intrusive,’ says Elia Zureik, the study’s lead researcher. [Source] [Anti-terrorism measures under fire as threat to privacy] [Anti-terror laws have Canadians fearing for privacy] The controversial idea of Canadians carrying a national identification card that bears their personal information has the support of more than half the country. The cards – strongly opposed by privacy commissioners and civil libertarians despite calls for their use in the wake of the 9/11 terror attacks – are considered a good idea by 53% of Canadians. [Resistance to National ID Card Dwindling] [Source]

 

NZ – New Zealand E-Government Strategy Released

State Services Minister Annette King has launched the 2006 E-Government Strategy saying e-government is not just about technology, but about putting people first. The latest version is the fourth version of the Strategy, and is called Enabling Transformation. “The key to the success of any strategy is its ability to adapt and respond,” says Ms King. “Enabling Transformation builds on previous strategies in the way they addressed the need for convenient and responsive government information and services, and it establishes a greater emphasis on making participation possible. “This strategy reflects the fact that e-government gives people more choices, makes them more productive and allows them to interact with government in a way that is convenient for them and respects their privacy.” [Source]

 

WW – Spam Levels Up Sharply in Month, Researchers Report

Researchers and IT managers are confirming security vendors’ claims that spam levels have spiked in the past month – some say by as much as 80% -- and show no signs of decreasing. “There are enormous amounts of spam; it’s shot up like crazy since the beginning of October,” says John Levine, president of consulting firm Taughannock Networks and co-chair of the Internet Research Task Force’s Anti-Spam Research Group, which operates a number of e-mail addresses that aren’t filtered for spam. [Source]

 

WW – Average Phishing “Catch” Soars, Survey Reports

Business is good for phishers. The size of their average catch increased almost five-fold, from $257 per victim last year to $1,244 in 2006. According to Gartner analyst Avivah Litan, this is happening because scammers are identifying higher-income targets, moving their phishing sites more frequently and switching up the types of business they try to impersonate. [Source] The study found that in the past year, individuals who earned more than $100,000 per year received an average of 112 phishing e-mails. For users in all income brackets, the figure was 74 phishing e-mails. [Source]

 

CA – Health Canada: Most Canadians Support Electronic Medical Files

A majority of Canadians support the idea of making all medical files electronic – as long as there are ways to ensure the data are kept secure. “Electronic health records hold a lot of promise in the minds of Canadians,” Mary Lysyk, a policy adviser for Health Canada, told the Electronic Health Information and Privacy Conference this week. Ms. Lysyk has been combing through five years worth of data detailing Canadian’s thoughts about having their medical records transferred into electronic formats. She said more than 65% of Canadians support the idea of having their medical records made electronic, but they also want privacy laws beefed up. She said more than 65% of Canadians believe that their privacy in general is eroding and approximately 54% are concerned that their medical records could be accessed by hackers. “We still have public trust,” said Ms. Lysyk. “But, trust is not a renewable resource – once it is lost it may not be regained.” [Source] [Infoway Chief Offers Check-Up on EHR Progress]

 

AU – Australia Defence Opts to Encrypt Laptop Data

Australia’s Department of Defence has decided to encrypt data stored on its 31,000 laptops after enduring public criticism for losing a computer disk that contained confidential details of a botched attempt to repatriate a soldier’s remains from Iraq. A spokeswoman for the Department of Defence this week confirmed that the department hadn’t used any kind of system to encrypt its laptops “in recent times”, even though 28 of them had been lost or stolen since June 2005. [Source]

 

EU – Information Chief Embarks on Education Campaign

The Information Commissioner’s Office has kicked off a DVD campaign aimed at businesses, to explain the Data Protection Act, and to help educate organizations about the growing problem of ID theft in the UK. The campaign focuses on mistakes that exacerbate ID theft as well as eight principles of sound data protection. The office has made 200,000 free DVDs available for distribution from the UK data protection officers and the Information Commissioner’s Web site. [Source]

 

WW – Survey: Privacy, Data Protection Top List for the First Time in 9 Years

Ernst & Young’s 9th Annual Global Information Security Survey has found that more than 75% of the 1,200 information security professionals surveyed in 48 countries identified privacy and data protection as critical areas that require more investment. The survey identified some cause for concern is the area of data security risks posed by vendors. About 55% of corporations acknowledged the lack of formal agreements with third-party suppliers. [Source] [Source] [Survey] [Compliance makes for better security]

 

UK – More Than 33.5 Million Camera Phones in Britain

There are now more than 33.5 million camera phones in Britain, according to a recent survey by the Mobile Data Association. This is more than just an interesting statistic – It means that there are 33.5 million people equipped to take a photograph or video of you in a public place and upload it on to the internet for the world to see. Many magazines and photo agencies pay for mobile phone pictures of celebrities taken by the public. Image-sharing sites such as YouTube and Flikr, which have a user base far in excess of any tabloid newspaper, are full of videos and photographs authored by citizen paparazzi. [Source]

 

WW – 20% of the World’s CCTV Cams in Britain

20 per cent of the world’s CCTV cameras operate in Britain. In fact, there is one camera for every 14 people in Britain, and you’re liable to be captured up to 300 times a day on CCTV. [Source]

 

WW – Discussion During IGF Against Internet Content Control

The first global Internet Governance Forum (IGF) was organized by U.N. in Athens between 30 October and 2 November 2006. The forum showed a strong and large opposition to Internet blocking and filtering, putting under pressure repressive governments such as China. The three sessions devoted to content regulation and control were dominated by the advocates of anti-censorship and access to knowledge that have criticized the state control of Internet content. Among other important subjects debated during the sessions there was the problem of unsolicited email communications. A group of six main anti-spam organizations made an alliance called Stop Spam Alliance and launched a website with information and advise on spam. [The Internet Governance Forum (IGF)] [Internet Governance Forum 2006 Greece] [Reporter’s Log: Internet Governance Forum] [The gossip issue] [Assault on State Censorship at the IGF] [IGF: more free content for the Internet] [Stop Spam Alliance]

 

WW – Internet Censorship Growing Worldwide: Survey

Internet censorship is spreading and becoming more sophisticated across the planet, even as users develop savvier ways around it, according to early results in the first-ever comprehensive global survey of Internet censorship. The Internet watchdog organization OpenNet Initiative is compiling a year’s worth of data gathered by nearly 50 cyberlaw, free-speech and network experts across as many countries, whose governments are known internet filterers. [Source] [Psiphon FAQ]

 

US – DOJ Study: 1% of Web Have Sex Content

About 1% of Web sites indexed by Google and Microsoft are sexually explicit, according to a U.S. government commissioned study. Government lawyers introduced the study in court this month as the Justice Department seeks to revive the 1998 Child Online Protection Act, which required commercial Web sites to collect a credit card number or other proof of age before allowing Internet users to view material deemed “harmful to minors.” [Source] [Source]

 

WW – Phishing Up; Bank Fraud Up, but Debit and Credit Card Losses Down

According to statistics from the UK’s Association of Payment Clearing Services (APACS), the number of phishing incidents detected in the first half of 2006 was 5,059, nearly a 1500% increase over the same period last year. The sharp rise also accounted for a 55% increase in losses to banks from online fraud, bringing that figure to £23 million. However, debit and credit card fraud losses fell 5% during that same period; APACS believes this is due to the increased use of chip-and-pin cards. Thieves are also turning to other methods, such as tampering with ATMs to turn them into card skimmers. [Source] [Source] [Source] [Source] [Source] [Source]

 

AU – Citibank eMail Looked Like Phish

Citibank Australia sent its customers an email explaining a new online banking sign on procedure, but the email was mistaken for a phishing attack. The message asked customers to log on to the Citibank web site and provide their credit card numbers and ATM PINs for authentication. Citibank’s security policy states “Customers should understand that Citibank will never send emails to customers to verify personal and/or account information ... . It is important you disregard and report emails which ... request any customer information ... .” A spokesperson said Citibank did not contradict its policy with the email because customers were told to type in the URL and the only link in the message was to the privacy policy. Citibank’s technical and fraud departments will investigate the situation. [Source]

 

WW – DNA Fingerprinting Sparks Fresh Worries

One morning 20 years ago, Alec Jeffreys stumbled upon DNA fingerprinting, identifying the patterns of genetic material that are unique to almost every individual. The discovery revolutionized everything from criminal investigations to family law. Jeffreys is still awed, and a bit worried, by the power of the technology he unleashed upon the world. “I think there are potentially major issues about genetic privacy,” Jeffreys said this week at a press briefing to mark the 20th anniversary of the discovery on Sept. 10, 1984. [Source]

 

US – Massachusetts State Requires Doctors to Identify HIV Patients

Starting Jan. 1, Massachusetts doctors will be required to provide the state with the name of anyone testing positive for HIV, regulators decided yesterday. Proponents of the move, approved unanimously by the state Public Health Council, say such reporting is a critical component of a national campaign to more precisely chart the AIDS epidemic. Doctors in Massachusetts now use codes rather than names to identify cases. The state is promising to keep identities confidential in secure computer files, but critics have expressed fear that the new policy will dissuade some people from getting tested for the virus and that no record system is foolproof. [Source]

 

US – Survey: Federal IT Officials Worry Most About Security Breaches

Cisco Systems did a survey of 200 federal technology officials earlier this year that found that almost 40% of the respondents say they worry about security breaches involving telecommuters. Concerns about security of mobile devices are impacting the government’s efforts to increase telecommuting. The survey also found that federal tech officials have placed great emphasis on compliance with a law that requires agencies to meet established computer security standards and achieving security goals required by the OMB. Despite high-profile government breaches this year, 58% of those surveyed believe their agencies are more secure, while just 12% feel less secure, according to the survey. The August phone survey of 200 U.S. government IT decision-makers also found they are putting more time into cybersecurity. 63% of respondents said they are spending more time on security issues than they were 2 years ago. [Source] [Source] [FBI estimates that more than 600,000 laptops are stolen every year]

 

US – Survey: 49 Million US Adults (1/5) Received Data Breach Notifications

Results from a Harris Interactive poll suggest that 49 million adults in the US have received notification in the last three years that their personal data have been compromised. Nearly half of the notifications came from government agencies; 29% came from financial institutions and 12% from commercial companies. 81% of respondents said the breach did not have harmful results for them. [Source] [Source]

 

EU – Germany Gives the Green Light to Citizen Identity Number

“All citizens of the Federal Republic, toddlers and octogenarians included, will hence from July 2007 onwards be assigned an identity number by the Federal Central Tax Office. The hitherto dispersed data stocks at some 5,500 registration offices encompassing the approximately 80 million persons registered in Germany will thereafter for the first time be managed centrally” [Source]

 

UK – UK Government Pushes Ahead on ID Card

Addressing Parliament on 15 November 2006, the Queen said the government’s programme for the new session would include further development of identity cards. The speech said that cards should be issued to UK nationals from 2009. It also confirmed plans to make biometric identity compulsory for non-European nationals coming to the UK to work and for those applying for a National Insurance number from 2008. [Source]

 

US – ID Theft Insurance Growing Trend

Identity-theft protection has evolved into a booming business, but the worth of some products remains questionable. More than 40% of consumers polled recently want homeowners’ insurance to cover identity theft. That interest spawned a variety of new products from insurance companies. “We’ve seen both the good and bad with identity-theft insurance,” said Jay Foley, executive director of the Identity Theft Resource Center. That’s why some insurers like State Farm Insurance haven’t rushed into the identity-protection market. “One reason we haven’t offered it is how do you identify (what to cover)? How do you price that?” asked a State Farm spokeswoman. [Source] [Armorpoint Unveils First On-Demand Identity Theft Management Solution]

 

US – Ping Identity Announces Digital Identity System for US Gov’t Agencies

Ping Identity Corporation announced today a new initiative designed to meet the unique cross-domain credentialing and federated identity needs of government agencies. Elements of this initiative include new capabilities now available in Ping Identity’s flagship product, PingFederate(tm), as well as certification that PingFederate is compliant with the US General Services Administration’s e-Authentication Initiative. Furthermore, in a companion release also issued today, Ping Identity announced a significant federated identity management contract award with the Regional Information Sharing Systems program administered by the US Department of Justice. [Source]

 

EU – EC Threatens Microsoft With Further Fines

The European Commission last week threatened Microsoft with further fines for failing to provide key technical information in its long-running antitrust case. The commission said the U.S. software giant has until Nov. 23 to submit information rivals need to write software programs that work smoothly with Microsoft’s Windows-based systems. [Source]

 

WW – Internet Explorer to Indicate Legitimate Websites

Starting early next year, the address bar in Internet Explorer 7 will turn green when surfing to a legitimate Web site – but only in some cases, not all. The colored address bar is designed to be a sign that a specific site can be trusted, giving people the green light to carry out transactions there. It is a weapon in the fight against phishing scams, which use fraudulent Web sites. [Source] [CA Browser Forum]

 

OECD – Cross-Border Privacy Law Enforcement

The OECD has undertaken an examination of challenges posed by cross-border aspects of privacy law enforcement, beginning with a Questionnaire addressed to OECD governments. Building on the results of the Questionnaire, the OECD has now released a Report on the Cross-border Enforcement of Privacy Laws. The report examines the law enforcement authorities and mechanisms that have been established with a particular focus on how they operate in the cross-border context. It describes existing arrangements to address the challenges and identifies a number of issues that require further consideration. [Source]

 

WW – E&Y Survey: Many Firms Do Not Manage Risks of Third-Party Data Sharing

Ernst & Young’s Global Information Security survey has found that more than half of the 1,200 organizations – both public and private – in nearly 50 countries admit that they have not managed the risks of sharing data with third parties. The survey also found that more than 75% of the organizations identified privacy and data security as a significant issue. [Source] [Global Information Security Survey ]

 

WW – Google CEO Speaks Out on Government Efforts to Obtain Users’ Search Queries

Eric Schmidt, speaking at the Web 2.0 Summit in San Francisco, said government efforts to force the company to turn over search queries and other Web activities “was a complete violation of our users’ rights.” According to this story, Schmidt took aim at the White House for its views on privacy. [Source]

 

US – ACLU Says Wiretapping Program Not Constitutional

Warrantless wiretaps that the government says are necessary to fight terrorism pose a threat to American democracy, the American Civil Liberties Union said in court papers filed this week. The ACLU is asking the 6th U.S. Circuit Court of Appeals to reinstate a lower court decision that said the Bush administration’s warrantless surveillance program is unconstitutional. President Bush has said the program is needed to detect terrorists. Opponents argue it oversteps constitutional boundaries on free speech, privacy and executive powers. “The government’s sweeping theory of executive power would allow the president to violate any law passed by Congress,” the ACLU said. [Source]

 

US – HP’s Dunn Pleads Not Guilty to ID theft

HP’s former chair Patricia Dunn has pleaded not guilt to four charges of identity theft and fraud, over her alleged role in the company’s campaign of spying on reporters, board members, and family members. She was the fifth person to enter a plea relating to the so-called Kona projects, in which the company, over the course of a year, hired private investigators to try to smoke out the source of board-level leaks to the media. HP’s former ethics officer and three of the PIs have also pleaded not guilty. [Source]

 

US – Opinion: Higher Ed Should Improve Privacy Performance

Robert Gellman, a Washington-based privacy and information policy consultant, writes in this piece for DMNews that higher education has not performed well when it comes to privacy protections. Noting that colleges and universities are along the most complex “from a privacy perspective,” Gellman cites the Bentley-Watchfire Survey of Online Privacy Practices in Higher Education to prove his point that the institutions’ privacy report cards leave much room for improvement. When it comes to privacy, universities are “about where American business was 10 years ago,” Gellman writes, adding that a handful “do it well, but privacy is not much of a priority.” Gellman predicts that privacy debacles will “start a new cycle of public pressure, legislation and, eventually, more school privacy.” [Source]

 

US – Pharmaceutical RFID Pilots Finds Promise, Problems

Cardinal Health released results of an extensive pilot project designed to assess the suitability of using UHF RFID technology for pharmaceutical supply chain tracking and e-pedigrees. Cardinal, an $81 billion global provider of products and services to many segments of the healthcare industry, said it is encouraged by the pilot, but also noted the technology and industry are not ready for adoption. The results were announced at the NACDS RFID Healthcare Industry Adoption Summit in Washington, DC. (For more background on the pilot, see Cardinal Health’s RFID Adoption Expands.) Previously at the same conference, Vue Technology announced an item-level RFID tracking system for retail pharmacies based on Gen2 UHF technology (see Vue Brings UHF Item-Level RFID to Pharmacies). The industry is far from consensus as to which technology is better for pharmaceutical tracking. In an RFID Update article last month, market research firm Venture Development noted resolution of the frequency question is a key factor impacting adoption (see VDC: Pharma Item-Level RFID to Set Precedent). Cardinal said its next steps include additional testing to try to improve read rates based on what it learned. Alien Technology, IBM, and VeriSign assisted with the pilot, which is not Cardinal’s sole RFID activity. In particular, the company is also involved with the RFID Viagra-tracking pilot with drug maker Pfizer (see Pfizer shipping RFID-tagged Viagra).

 

CA – BC Firm Pushing RFID for License Plates

Spending millions of dollars on a police license plate reading system is short-sighted when the money could finance a much more comprehensive and useful system, says the president of Vancouver-based EVI Management Group. EVI is lobbying B.C. to install radio frequency ID chips in B.C. license plates which would be read by a network of scanners across the Lower Mainland. He said the British-designed “e-plate” system could identify suspect cars in real time and track them wherever they go around the region. “The police system John Les has doesn’t give you a geo-coordinate of the vehicles,” he said. “Six hundred plates per hour are being read, but where are they all? Where do they go?” With chip implants embedded in license plates, he said, police cars equipped with readers could detect suspect cars up to 100 metres away -parked in back alleys, inside garages or covered under tarps. Criminals also couldn’t avoid detection by obscuring the plate number. [Source]

 

CA – Ottawa Professor: Implantable Chips Require More Discussion in Canada

Ian Kerr, a Canada Research Chair in Ethics, Law and Technology, warned during a conference on electronic health information and privacy that Canadians should explore the societal issues of RFID or other technology used to facilitate medical care and electronic health records. Patricia Kosseim, General Counsel with the Office of the Privacy Commissioner of Canada, noted that while there are good arguments for e-medical records, there are privacy concerns associated with the use of patient records for research, employment or insurance. [Source]

 

Security

 

US – Survey: Business Leaders Don’t Trust Their Own Security

Almost one in every three of the more than 1,700 senior-level corporate and technology leader respondents in a new international survey do not trust their companies’ own abilities to handle private or sensitive information, and that same number are either unsure or don’t believe that most of their business partners consider them to be trusted enterprises. These and other findings are part of a broad research project from Blue Bell, Pa.-based Unisys Corp., called the Unisys Trusted Enterprise Index, a survey designed to measure the importance, impact and influence of trust, privacy and security within the corporate world. Conducted in partnership with the Ponemon Institute, a privacy research organization, the study also found that despite a growing awareness of risk management and security issues in the corporate world, more than one-third of companies polled do not task senior leaders with protecting the trust that customers, investors and even their own employees have in those companies. [Source]

 

US – Information Security Handbook: A Guide for Managers

NIST has release of Special Publication 800-100, Information Security Handbook: A Guide for Managers. This Information Security Handbook provides a broad overview of information security program elements to assist managers in understanding how to establish and implement an information security program. The purpose of this publication is to inform members of the information security management team [agency heads, chief information officers (CIO), senior agency information security officers (SAISO), and security managers] about various aspects of information security that they will be expected to implement and oversee in their respective organizations. [Source]

 

AU – Australian Privacy Group Pans Access Card

The Australian Privacy Foundation (APF) has demanded the national Access Card be canned because it is unjustified, unprecedented, unpopular, unsafe, wasteful and discriminatory. The APF’s has called on the government for full disclosure on the initial KPMG validity report, as well as the Privacy Impact Assessment, as had been promised. “There is a fundamental contradiction in this entire approach. The government says you can trust us with all your data, but we can’t trust you to see our privacy advice.” [Source]

 

US – HSPD-12 Cards Open to Function Creep

The U.S. government’s new identity credentials will provide better building security once agencies acquire card readers and other information technology infrastructure products. But agencies and security vendors are already thinking of additional uses for the smart card identity credentials that Homeland Security Presidential Directive 12 required agencies to begin issuing Oct. 27. Security experts who advise federal agencies say the applications for secure identity credentials are nearly limitless, and the secret to their versatility is in the cards. [Source]

 

CA – Ottawa Boosts Funding to Transit Surveillance

Transport Minister Lawrence Cannon has awarded $80 million to six cities to prevent transit bombings. Société de transport de Montréal has already installed 531 closed-circuit cameras and plans to have 1,200 in place by next June. Federal funding would help to improve an already safe Montreal subway system. The TTC has plans to spend $60 million in the next year alone to enhance security. Earlier this year, it said $10 million from the federal government is not enough to buy 3,000 cameras for all its subway stations, and outfit its 1,700 buses and 300 streetcars with cameras, as well as hire 100 transit constables. Toronto, Ottawa-Gatineau, Montreal, Vancouver, Calgary and Edmonton all will receive federal funding. The money is meant to be used for new surveillance networks including cameras, communications and access-control equipment. The money is part of the $1.4 billion for security announced in last spring’s federal budget. [Source] [Ottawa beefs up security on urban transit] [Source]

 

US – California Car Rental Firm Settles With Prosecutors

Under a settlement with the California Attorney General’s Office and the San Mateo County District Attorney’s Office, Fox Rent A Car has agreed to pay nearly $700,000 to customers and law enforcement agencies. The settlement prevents the company from requiring its customers to buy unnecessary insurance and from using global positioning devices to track customers who traveled beyond certain borders. The company, which denied any wrongdoing, forced consumers who traveled outside California, Nevada or Arizona to pay fees. [Source]

 

US – Cell Phone Companies See Promise in Location-Based Services

Cell phones that allow users to track their friends or take advantage of other location-based services are making their way into the marketplace. Companies have been cautious to offer the services, partly because of concerns about privacy. However, location-based services are expected to explode onto the consumer scene with analysts predicting that more than half of U.S. cell phone users will be using the technology by 2010. Currently, less than 2% of 219 million U.S. cell phone subscribers have tried these services, according to IDC. [Source] [Mobile phones that track your buddies] [GPS Surveillance Creeps into Daily Life]

 

US – Feds Make Progress with Fund for ChoicePoint Victims (But Barely)

Almost 10 months after a landmark settlement that established a $5 million redress fund for consumers impacted by the ChoicePoint privacy breach, the U.S. Federal Trade Commission (FTC) is about to start collecting information on what the breach actually cost identity theft victims. The FTC also has spent the first part of the $5 million fund, not on consumer compensation but on a contract “redress administrator” who will help gather data and crunch numbers about costs incurred by the victims. Jessica Rich of the FTC’s Bureau of Consumer Protection said the agency has been working with law enforcement to identify who among the 163,000 consumers affected had actually become victims of identity theft. She said the FTC’s original estimate that 800 people had their personal information misused has not changed, but that the process has taken longer than anticipated because of the difficulty in tracing identity thefts back to the ChoicePoint breach. [Source]

 

US – New Congress Breathes New Life into Efforts To Pass ID Theft, Pretexting Bills

Pretexting legislation may face enhanced prospects for passage under the new Congress. Sen. Hillary Clinton is pursuing anti-pretexting measures in her “Privacy Bill of Rights” legislation, which includes a host of additional consumer protections, including tools to help prevent identity theft. This article in consumeraffairs.com predicts that “many issues of privacy, consumers’ digital rights, and technology rights have new life in them.” [Source]

 

US – Republicans Propose Last-Minute Spy Bill

The outgoing Republican chairman of a key U.S. Senate committee has made a last-minute attempt at giving the Bush administration what he calls the necessary “resources” for carrying out its phone call and Internet surveillance within the law, but critics remain unconvinced. [Source]

 

--------