1. Privacy Chapter 5 James Balestrery Joshua Moulton Inesa Diaz

2. Agenda What Is Privacy ? “Electronic Trail” of Information New Technologies and the Law Data Mining Identity Theft Problem How Do We Preserve Our Privacy in the Information Age?

3. Definition Privacy as a notion of access, where access means either physical proximity to a person or knowledge about that person. Where to draw the line between what is private and what is public ? In summary, privacy is a social arrangement that allows individuals to have some level of control over who is able to gain access to their physical selves and their personal information.

4. Harms Privacy provides people with a way of covering up actions that are immoral or illegal. Too much privacy creates a closure around a person or a family cell. –Inability to receive support from outside. –Inability to receive protection from outside.

5. Benefits Privacy as an indication of people’s responsibility. Privacy allows people to develop as individuals. An opportunity to shut out the world, be creative. An opportunity to develop different kinds of relationships with different people.

6. Is There a Natural Right to Privacy? 18 th century. A natural right. Historically privacy is seen in terms of control over personal territory, and privacy rights evolve out of property rights. 19 th century. Political, social and economic changes in modern society demand recognition of new kinds of legal rights. Warren & Brandeis. Every ‘privacy right’ violation is a violation of another right. There are a cluster of rights associated with privacy. Thompson. Prudential right. Recognition of some privacy rights because granting these rights is to the benefit of society. Rosenberg. Example: telemarketing.

7. Privacy and Trust Modern technology creates a society of strangers by increasing our privacy. Loss of trust. Society must get information out of people to establish reputations. –Ordeal –Credentials

8. Disclosing Information Public information is information you provide to an organization that has the right to share it with other organizations. –Telephone directory.

9. Disclosing Information Public record contains information about an incident or action reported to a government agency for the purpose of informing the public. –Birth certificate –Motor vehicle record –Criminal record

10. Disclosing Information Personal information is information that is not public or part of a public record. It can become public through –Voluntary –Involuntary –Statutory

11. Public Information Rewards or loyalty programs Body scanners Digital Video recorders (TiVo) Automobile “Black Boxes” Enhanced 911 service RFID Implanted chips Cookies Spyware

12. 5.5 US Legislation Fair Credit Reporting Act 1970 (Revised 1996)‏ Promote accuracy and privacy of credit information Ensures negative information does not stay on record permanently (except criminal record)‏ The Family Education Rights and Privacy Act 1974 Students 18+ years can request changes be made to educational records that contain errors Student records cannot be released without permission of student

13. Video Privacy Protection Act 1988 Videotape service providers cannot disclose rental records without customers consent Personally identifiable records must be destroyed after 1 year Financial Services Modernization Act 1999 Requires financial institutions to prevent unauthorized access to customer information Financial institutions must disclose privacy policy to customers Children's Online Privacy Protection Act 2000 Online services must obtain parental consent before collecting information about web users < 12 years old

14. Health Insurance Portability and Accountability Act 1996 Health Insurance guidelines to protect privacy of patients Forbid Heath Care providers from giving info to life insurance companies and banks Customers have a right to see their medical records upon request, and can request corrections to errors within the records.

15. 5.6 Public Records US Government has thousands of databases containing records on its citizens. Census Records Census performed every 10 years 1790-1850 Questions on census increase, government requires more information (job class, school attendance, illiteracy, occupations)‏ 1940 statistical sample put to use using census information Federal law prohibits Census Bureau for revealing census information except in times of emergency WWII Census Bureau provided US Gov with locations of Japanese Americans

16. Internal Revenue Service Records IRS collects ~$2 trillion in taxes each year IRS data contains personal information which has been misused by employees IRS claims to have “misplaced” hundreds of diskettes and tapes containing income tax data 2003 consumer protection groups complain that H&R Block website was requiring people to consent to their information to be used in cross-marketing. This act is against the law

17. FBI National Crime Info Center 2000 This is a collection of databases containing information activities of fed, state, local law enforcement agencies in the US, US Virgin Islands, Puerto Rico, and Canada This currently consists of ~39 million records Databases contain information such as: wanted persons, criminal history, people incarcerated in fed prisons, convicted sex offenders, unidentified persons, people believed to be a threat to the President, foreign fugitives, gang members, suspected terrorists, etc... 80,000 Law enforcement agencies have access to these records NCIC processes more then 2 million requests each day with a average response time of 1 second

18. NCIC privacy violations Erroneous Records lead to innocent arrests Innocent people are arrested because they have the same name as a wanted person NCIC has records on people not accused of any crime (opponents to the Vietnam war)‏ Corrupt employees sell information, manipulate, and delete records People with access to NCIC have used it illegally to screen employees and acquaintances

19. Privacy Act 1974 “bill of rights for the Information Age” Prohibits the use of secretive data record systems Ensures there is a way for a person to find out what information about them exists and how it is being used Prohibits the use of personal information to be used for other purposes without the person's consent There must be a way for a person to correct or amend a record of identifiable information Any organization creating or maintaining such records is obligated to ensure the integrity, correctness, and protection of such information

20. 5.7 Government Surveillance Wire taps have been taking place since 1890s 1892-1920 New York Police use unlawful wiretaps to listen to conversations at hotels, between lawyers and patients, doctors and patients, and priests and penitents Wire taps used to catch bootleggers 1919-1933 1934 Congress pass Federal Communications Act making wiretaps illegal FBI Continues secret wiretapping throughout WWII, information they collected was considered confidential NSA 1952 – Operation Shamrock, monitoring of all messages entering and leaving the country

21. 5.8 Legislation Authorizing Wiretapping Vietnam War era 1968 Congress pass Title III of Omnibus Crime Control and Safe Streets Acts allowing court ordered wiretaps for up to 30 days Digital Telephony Act 1994 requires phone companies to provide law enforcement a means of tracing calls, listen to calls, and intercept email messages. FBI uses ambiguities of this act to extract digital phone numbers, credit card numbers, and bank account numbers 2005 FCC demands that broadband providers provide a means of access to VoIP communications

22. US Patriot Act 2001 Designed to prevent future terrorist attacks against the US Provided law enforcement greater surveillance powers, police can use pen registers on the net to track email addresses and URLs without probably cause Extends court ordered wire taps to the entire country Roving surveillance performed for the purpose of intelligence. Law enforcement is not required to report on its findings Secretary of Treasury increased powers to regulate banks and prevent money laundering Made it more difficult for terrorists to enter the US Defined new crimes and penalties for terrorist activity Law enforcement can enter and search a person's premises without a search warrant

23. Patriot Act makes it easier for FBI to collect info on business, medical, educational, library, church/mosque/synagogue records 100s of cities and several states pass anti-Patriot Act resolutions 2003 Patriot Act II proposed but not passed by congress

24. Data Mining Lots of random data and transactions. “Snapshots” Searching through one or more databases to generate new information by combining facts Information on people is valuable product Secondary use

25. Data Mining Commonly used technique –IRS –Banks –Police agencies Syndromic Surveillance System (N.Y.C) –50,000 pieces of info a day –Find patterns to use for early warning

26. TIA–Total Information Awareness Government program to capture “information signature” of people Combine records with biometric identity 2003- Program defunded by Congress. Changed name to Terrorist Information Awareness Benefits = Could detect possible terrorist activity Criticisms = Too much centralized data, no citizen access or review and Big Brother effect.

27. Transaction Data Ownership Who owns rights to data produced by transactions? –Seller/Buyer/Neither –Transactions are public information –Privacy can be purchased Opt-in Vs. Opt-out –Hippocratic databases

28. Identity Theft Use of another persons identity to get access to information or documents Leading form of Identity theft? Why? - 15 million Americans were victims in 2006 (Gartner.com) Types = Shoulder surfing, dumpster diving, phishing and skimmers. Mostly low-tech

29. Social Security Number S.S. Act of 1935. Created for sole use by Social Security Administration Why it became so popular Problems with using S.S.N –Not unique –No error-detection capability –Not a verified form or identification. Easily copied National ID card

30. Encryption Definition = Transforming a message in order to conceal its meaning. Why it is important Types –Symmetric Encryption –Pubic Key Cryptography (Diffie and Hellman) Asymmetric = 2 keys: Public/Private Mathematical relationship between keys makes possible security breaches.

31. Other Instances of Encryption Pretty Good Privacy (PGP) Clinton’s “Clipper” Program (1993) Digital Cash –Online or Off-line –Safeguards –Pros and Cons

32. THE END Questions?