Again: loss of personal data by public officials in the UK

Less than two months after the loss of the personal details of 25 million people by the UK's tax authorities (see this blog entry), another substantial loss of personal data has occurred in Britain. As the BBC website writes, a laptop containing personal details of 600.000 people has been stolen from a Royal Navy officer in the Birmingham area.

The data are from people who have expressed an interest in, or joined, the Royal Navy, Marines, or Air Force, and they are the more detailed the further progressed the wish for joining was:

• For people who had actually submitted an application, data held on that laptop may include passport details, National Insurance numbers, drivers' licence details, family details, doctors' addresses, National Health Service numbers and bank details.


• For people who had merely made a casual enquiry, only a name may have been on the record.

The BBC gives no details as to the relative sizes of these two groups, but mentions that the Ministry of Defense is about to write to 3.500 people whose bank details were on the laptop's database.

Apparently the laptop was stolen from the officer's car which was parked overnight in the Edgbaston area of Birmingham.

One can only hope that hard questions will be asked of those responsible for this failure, questions like the following:

• Why was the data on that laptop?


• Was there authorisation for the data to leave whatever MoD premises they were originally collected in?


• Was the data protected through encryption?


• Why, in the light of the sensitivity of the data, did the officer choose to leave the laptop in the car?


• Was he authorized to do that?


• And: why was he not shackled to the laptop?

In the old days (and in movies) that was how they used to protect valuable things…

Update: The British Secretary of Defense, Des Brown, had to acknowledge before the House of Commons that already in 2005 two laptops had been lost containing personal data of members of the armed forces. He also said that on the present laptop had been the detailed data of only 153.000 people, but admitted that they had not been encrypted. Furthermore he said that in this case MoD security regulations had been breached, but did not go into details.

He also announced — yet another security review! (After each of the data debacles of the last weeks, the Brown government has promised one of those...). You can find a summary of his points and the full text of his statement to the House of Commons here.

Technorati Tags: owl-content, politics, privacy

Jeremy Clarkson and identity theft

Well, first of all, a happy new year to my readers! And I am glad to be able to report that page visits to this blog more than doubled in 2007 over 2006, to well over 5000 pageviews. I am very happy about this and will take it as a reminder to update this blog more often than I have recently done (take that with a grain of salt, like all new year's resolutions...).

Another reason to be upbeat is a story reported by the BBC today. It concerns Jeremy Clarkson, a British TV presenter specialising in motor journalism, and in my personal view one of the most unhappy examples of British jingoism-cum-machismo, someone who revels in almost every conceivable sort of public insult, especially against foreigners. Even his employer, the BBC, has described him as "not a man given to considered opinion".

Clarkson has a column in the tabloid The Sun, in which he recently made fun of the concerns about the lost personal details of 25 million British people due to negligence of the British tax authorities some six weeks ago (see this blog entry). Clarkson, alleging that this was all unnecessary fuss about nothing, proceeded to prove his point by publishing his account details (including account number and sort code) as well as instructions about how to find out his address in the newspaper.

"All you'll be able to do with them is put money into my account. Not take it out. Honestly, I've never known such a palaver about nothing," he teased his readers. But not so, as he had to find out: when opening his bank statement recently, he found that someone had used that information to set up a direct debit to a charity which took £500 out of his account.

It is to Clarkson's credit that he published the mishap, and even admitted: "I was wrong and I have been punished for my mistake." And: "Contrary to what I said at the time, we must go after the idiots who lost the discs and stick cocktail sticks in their eyes until they beg for mercy."

While losing £500 will not ruin this wealthy man, he had to learn the hard way (and some may be surprised he is capable of even that). But will it turn him into a champion of data protection in the future? Only time will tell...

Technorati Tags: owl-content, privacy

British tax authorities lose personal details of 25 million people

A crass case of neglect and breach of data protection legislation has led to the loss of discs containing the names, addresses, dates of birth, bank account details and National Insurance numbers of 25 million people in the United Kingdom, it was revealed today (see reports by the BBC, the Financial Times, the Guardian and The Times).

The data (they are the complete records of all 7.25 million families in the UK with a child under 16 years of age) were on two CD-ROMS which the tax authority (Her Majesty's Revenue & Customs or HMRC for short) shipped on 18 October 2007 with the courier TNT – who operate the HMRC's post system. However, they were neither recorded or registered, and failed to arrive at their destination, the National Accounting Office.

As sending the data in this way constituted a breach of rules (which was repeated a few days later, although this time as a registered parcel which reached its destination), the chairman of HMRC, Paul Gray, has resigned his post. British Chancellor of the Exchequer Alistair Darling told the House of Commons today that there was no evidence "that this data has found its way into the wrong hands". But he also admitted that the millions of families concerned were at risk from fraud and identity theft and advised them "to monitor their accounts and guard against any unusual activity."

It is difficult to understand why the HMRC chose to transfer these data at all in a physical manner rather than transferring them in encrypted format over a secure high-speed data link, as one would expect to be standard in the early 21st century. This is a massive blunder which will bring anxiousness and discomfort (to say the least) to countless British citizens for some time to come.

Regular readers of this blog will recall previous examples of private sector data security breaches (for example, the TJX case, or that of Marriott International, with links to more cases covered in this blog). Today's episode shows that the public sector is similarly careless and incompetent in this respect. For any observer of British e-government and its long record of failures, this will be no surprise.

One probably needs no special prophetic powers to predict that the Labour government's plans for a National Identity Register and for an equally comprehensive electronic health care records system will now again come up for discussion and under increased scrutiny. But so far, one has to say, the British government has not let the rather dismal past record in this field (or reasoned argument) come in the way of its grand plans for the future...

Technorati Tags: owl-content, politics, privacy

Google offers olive branch to privacy activists

Google, the data behemoth and "internet superpower" (The Economist) has recently suffered from extensive sympathy withdrawal. Founded by two Stanford graduate students and rising meteorically to utter domination of the internet search market (recent market share: 48 per cent), the company originally managed to present a public face that endeared it to many, summed up in its corporate slogan "don't be evil". This translated nicely into healthy corporate profits: in the first quarter of 2007, Google earned 1 bn. US $ (up 69 per cent on the previous year) on a turnover of 2.53 bn. US $.

But popularity can fade quickly, the company had to learn. Criticisms were mounted about Google's acceptance of the Chinese government's censorship demands, and the unparalleled data collection of the firm triggered sceptical questions as to its goals. These questions became more pressing as Google came bottom in a privacy ranking of internet service companies conducted by Privacy International this summer.

Now Google has decided to reclaim the moral high ground by publicly calling for new international laws to be set up to protect personal information online (see reports by the Financial Times, the BBC, and c't [in German]). At a UNESCO conference on "Internet Ethics", the firm's Global Privacy Counsel Peter Fleischer called for a harmonisation of international privacy standards, noting that the existing situation without global standards left consumers largely unprotected — but that it also harmed economic progress.

Fleischer advocated the adoption of the rules agreed by APEC (Asia-Pacific Economic Cooperation) in 2004. While the head of the EU's "Article 29" working group of data protection commissioners, Germany's Peter Schaar, welcomed Google's initiative, some scepticism is perhaps in place. One of Australia's leading experts on data protection, Graham Greenleaf from the University of New South Wales, expressed great caution at the time the APEC proposals were discussed and passed. And the summary of the standard given on the APEC website looks rather simplistic.

Of course buzz words like "global standards" sound attractive, but ultimately the quality of that standard is decisive. How do they compare against what many so far regard as the "gold standard" in privacy protection, the EU directive of 1995? If someone knows the source of a comparative analysis of the two, I'd be grateful for a hint! Until then, I reserve my judgement on the merit of this initiative.

Technorati Tags: owl-content, politics, privacy

Senior UK judge wants everyone on DNA database for fairness reasons

One of the United Kingdom's most senior judges, Lord Justice Sedley, today demanded that every UK resident and every visitor to the country should have their DNA recorded on the national DNA database (see, respectively, the BBC news website, the Guardian, the Daily Mail, and the Daily Telegraph on this).

Sir Stephen Sedley, a senior appeal court judge, described the current system as "indefensible" and argued that to fix it there were only two ways. Reducing the database could lead to serious offenders escaping conviction when they would otherwise have been brought to justice, so this would be "a disaster". Therefore, the only option was to expand the database to cover the whole population and all those who visit the UK. (The population is about 60 mio., and another 33 mio. visit the UK per year [see National Statistics website]).

The UK's national DNA database is already the world’s largest: Two years ago, in 2005, almost 3.5 mio samples were on that database – or 5.2 per cent of the overall population. Next year, the database is planned to cover 4.25 mio samples or 7.5 per cent of the population. (For comparison: The EU average is currently slightly above 1 per cent, and in the United States, the respective figure is 0.5 per cent. The UK, in other words, is literally miles ahead of other, similar countries in this area, holding the data of between 6 and 15 times as many of their citizens as other countries.)

Judge Sedley (who, interestingly, is also President of the British Institute of Human Rights) received a mix of criticism and support for his views. Home Office minister Tony McNulty said on the Today programme that he was "broadly sympathetic" to the judge's views which had "a real logic" to them; Prime Minister Gordon Brown's spokesman, however, denied this morning that there were any plans to introduce a universal database; opposition politicians from the Liberal Democrats and the Conservatives strongly criticised the idea. The Information Commissioner, Richard Thomas, warned that it raised serious issues around the criminal justice system: "if you get the knock on the door saying 'we’ve found your DNA’, you’ve got to start proving your innocence". And Liberty director Shami Chakrabarti called it "a chilling proposal, ripe for indignity, error and abuse".

Technorati Tags: owl-content, privacy, surveillance

Back at the blog — and a job vacancy to fill!

This is the first entry to the blog in two months, and first of all I have to apologize for not writing earlier. Lots of interesting things have been happening in the area of privacy, from EU decisions about cooperation and data sharing in law enforcement to Germany debating online-searches of citizens' personal computers to a leading UK police officer expressing fears about the impact of CCTV to the Privacy International ranking of Internet Service Companies to the EU and USA agreeing on a new data sharing deal for flight passenger data.

But closer to home, things have been rather frantic, and that has kept me busy. The two main things were

• an international workshop on the subject of "Privacy and Information: Modes of Regulation" that I conducted with my colleague Charles Raab (Edinburgh University) under the auspices of the European Consortium for Political Research in Helsinki. Our call for papers drew an international and interdisciplinary response, and Charles and I were very happy with the papers presented and the discussions that ensued in the week in Helsinki. Another memorable thing is that our stay in Helsinki coincided with the finale of the European Song Contest, which meant that while hotel rooms were at a premium, we were entertained by loud music and the sight of hordes of international fans supporting their home music teams! If you are interested in the papers presented at the workshop, you will eventually be able to find them at the ECPR website's list of workshops. Our workshop is number 26, so you have to scroll all the way down. We hope to produce a publication in a special issue of an academic journal, or in a book from this.


• The other big news is that the Economic and Social Research Council (ESRC) has granted me an award for a two year project on research into privacy policy. The project will run for two years and will eventually have its own website to disseminate information. For the time being, there is a small project page on my website that has a brief description of the project (the full title is "Coping with innovation: The regulation of personal information in comparative perspective", and it will compare the United States, the United Kingdom, Germany, and Sweden across three topics of regulatory policy: RFID chips, CCTV cameras, and biometric passports).

But most importantly, I have a postdoc position to fill for that project. The deadline for applications is 6 July, so if you're interested, hurry up! You can find details about the tasks, remuneration etc. via the links at the project page. The job will be based in the Department of Politics and International Relations of Oxford University, one of the leading politics departments in Europe. So, if you know of someone who might fit the bill, please forward this information and encourage them to apply!

Technorati Tags: owl-content, politics, privacy, surveillance

Germany to introduce unique personal identifier — for tax purposes

It has been a long time in the making — since 2003, to be precise, when the Tax Bill passed in December of that year created the provisions, but it is only now that the implementation takes place: on 1 July 2007, the German Federal Tax Office (Bundeszentralamt für Steuern) will start building a new database which will have an eleven digit unique identifier (or "tax ID") for every person in the Federal Republic of Germany. The details can be found in § 139b of the Tax Code (Abgabenordnung).

This is the first time that a central register of the whole population will be created, and it will contain the person's number, name, doctoral title (if present — I always knew Germans were nuts about these…), the day and place of birth, the gender, the residential address, and ultimately also the day of death. For these data will only be deleted twenty years after that fateful event. The taxt ID will be created at birth, not only when the person becomes liable for tax.

German data protection officers have been very critical of this — most recently, the Federal Data Protection Officer in his annual report 2005/06 which was presented only two weeks ago (see page 100 of the report which can be downloaded here). But these interventions only limited the use to taxation issues so far — whether any "mission creep" will set in once this wonderful data pool exists, remains to be seen. There have been other cases in which it was tried to extend the purpose ex post, most recently the Autobahn road toll data (see this blog post from November 2005).

What seems remarkable is the complete public disinterest in what is arguably a more serious and concrete threat to every single German citizens' privacy than many other cases which are far more in the public spotlight, especially since it has been announced for more than three years which would have allowed plenty of time to mobilize against it. But then, my experience as a political scientist has always taught me that it is foolish to assume a linear relationship between facts and public perception... Or is it just that activists don't read the tax code?

Technorati Tags: owl-content, politics, privacy

House of Commons and House of Lords launch inquiries into the "surveillance society"

The subject of privacy and surveillance has been moving up the United Kingdom's political agenda since last autumn, as I have argued in this blog on various occasions (see here, here, here and here). Now, it seems, the debate has reached the Houses of Parliament, after various reports and many newspaper stories (as well as some recent accidents) have drawn substantial attention to it.

Both the House of Commons and the House of Lords have recently launched inquiries into questions of surveillance and data collection. The House of Commons does it under the auspices of its Select Committee on Home Affairs, and its inquiry will be concerned with the question "A Surveillance Society?" The inquiry (the oral evidence phase of which started yesterday, 1 May, with evidence being given by the Information Commissioner) will

"focus on Home Office responsibilities such as identity cards, the National DNA Database and CCTV, but where relevant will look also at other departments’ responsibilities in this area, for instance the implications of databases being developed by the Department of Health and the DfES for use in the fight against crime."

The Lords inquiry "to investigate the impact of surveillance and data collection" takes place through the Constitution Committee and will focus

"on the constitutional implications of the collection and use of surveillance and other personal data by the State and (insofar as they can be used by the State) private companies, particularly with regard to the impact on the relationship between citizen and state."

A "call for evidence" has been issued, and anybody who has something to offer can write to the House of Lords by Friday, 8 June 2007. Twelve Lords will conduct the inquiry, and my colleague Charles Raab from the University of Edinburgh has been appointed as Specialist Adviser for the duration of the inquiry.

The transparency of the procedures and the breadth of (especially the Lords') inquiry is certainly laudable, and it will be very interesting to observe the deliberations of the committees and read (and compare!) their respective results.

Technorati Tags: owl-content, politics, privacy, surveillance

UK health agency erroneously publishes doctors' personal details online

The body responsible for recruitment into Britain's National Health Service, the NHS Medical Training Application Service or MTAS, has mistakenly published the confidential personal details of junior doctors on its website.

The breach of security was revealed by Channel 4, who report on their website: "This is astonishing. Not only can we see what they wrote in their applications; their addresses; their phone numbers; who their referees are. We can also see if there were white, heterosexual, gay Asian, Christian, Jewish or Hindu, and we can also see if they have got police records and what the crime was."

The incident was widely reported in the UK (see websites of the BBC here and here, as well as the Guardian and the Times), and it is likely to add further to the troubles of a government keen to convince its citizens that both the planned ID card and patients' medical records databases will be safe.

For anyone interested in the political science perspective on the issue of why the UK government has so much trouble with IT systems, I recommend my colleague Helen Margetts' work, and especially her new co-authored book on "Digital Era Governance".

Update: Channel 4 reports that there was a further security problem with doctors' personal data. As of writing this, the MTAS website is still offline "due to planned essential maintenance work"...

Technorati Tags: owl-content, politics, privacy

Massive theft of credit card data at TJX in US and UK

As the Boston Globe reports in its online edition today, retail firm TJX Companies, Inc. has been the subject of a hacker attack that has resulted in the biggest theft of credit and debit card numbers ever.

TJX operates around 2500 stores and owns T.J. Maxx, Marshall's and A.J. Wright in the United States as well as Winners in Canada and T.K. Maxx in the UK and Ireland.

As the firm disclosed in a regulatory filing to the SEC yesterday, the hacker(s) had been active since 2005 in its system. It was only in December 2006 that the intrusion was detected and stopped. TJX estimates that at least 45.7 mio. credit and debit card numbers were compromised in computer systems at its headquarters in Framingham, Mass. and Watford (UK). An apologetic letter from the company's CEO on its website dates from February 21 and gives information on contact numbers and recommended steps for customers. It als says that it is sending letters to the estimated 455,000 customers whose driver's license numbers, state identification numbers, or military identification numbers and names and addresses were believed to have been stolen.

Technorati Tags: owl-content, privacy

Further evidence of privacy and surveillance debate moving up the agenda in the UK

The British Royal Academy of Engineering (self description: "we bring together the country’s most eminent engineers from all disciplines to promote excellence in the science, art and practice of engineering") has just published an extensive report on "Dilemmas of Privacy and Surveillance" (available as a pdf file here).

The 64 page report, drawn up by 12 strong working group over the course of the last year (which included my colleague Bill Dutton from the Oxford Internet Institute), puts the focus on the ambiguities of the technological developments rather than predicting either Utopia or Dystopia. But rather than having to choose between liberty and security, the report argues "that, with the right engineering solutions, we can have both increased privacy and more security." And, of course: "Engineers have a key role in achieving the right balance." Who would have thought that, coming from this source ;-)

But more seriously again, the report gives a serious and balanced discussion, and lots of information on topics such as CCTV, loyalty cards, mobile phones, but also technology to protect privacy. Concluding with 10 recommendations (which include a call for increased powers for the Information Commissioner and for technology to be designed with privacy protection in mind), it is well placed to inform public debate on the topic in the UK.

As I argued previously in this blog (see here and here), we can see a broadening of the political and societal debate around privacy and surveillance in the United Kingdom in the last months, and this report is further evidence of it.

Technorati Tags: owl-content, privacy, surveillance

UK reveals record number of telephone, email, and post monitoring

The United Kingdom is checking on its citizens' telephone conversations, email exchanges, and posted letters like never before (and — as far as I know — like no other country democracy). A report in todays The Times reveals that 439,000 requests were made by secret agencies and other authorised bodies to monitor people’s telephone calls, e-mails and post in a 15-month period from 2005 to 2006.

The newspaper article draws on the report of the "Interceptions of Communications Commissioner" — a somewhat Orwellian sounding title for an office about which I had never heard before and for which a quick google throws up nothing except two references in debates at the House of Lords many years ago. More detailed investigation, however, reveals that the person in question is Sir Swinton Thomas, a former High Court Judge, who has been said Commissioner since April 2000, and that his office is created by Section 57(1) of the Regulation of Investigatory Powers Act 2000.

The report (apparently his first in seven years in office) covers no less than 795 bodies that are empowered to seek out communications data. Besides the usual suspects such as MI5, MI6 and GCHQ, the signals intelligence centre in Cheltenham, they also include 52 police forces, 475 local authorities and 108 other organisations such as the Serious Fraud Office and the Financial Services Authority. The report also reveals that 4,000 errors were reported, of which 67 were mistakes concerning direct interception of communications. Sir Swinton Thomas is quoted by The Times as describing that figure as “unacceptably high”.

This is where I disagree. I think that 67 mistakes in 439,000 is as good a ratio as you can get — some 0.016 per cent. It is not 67 that is unacceptably high; it is 439,000!

Update: The present Interception of Communications Commissioner is Sir Paul Kennedy, who was appointed in 2006 for three years, writes Spyblog (see also here). So it was his predecessor who wrote the report and not the present Commissioner; I am sure there is a reason for this, even if I can't think of one right now…

Further Update: Spyblog points out that the date of the report (available here) is 19 December 2006 and speculates that the original report may have been toned down which would account for its delayed publication. The letter accompanying the report also makes clear that this is the 6th Annual Report, although The Times in the article referenced above calls it "the first report of its kind". As I have not had a chance to go hunting for the other reports, I cannot solve the contradiction between these two claims.

Technorati Tags: owl-content, politics, privacy, surveillance

Tories warn industry that their government will scrap ID card project

The British Conservative Party has issued a warning to companies intending to tender for work in the multibillion Pound ID card scheme that a future Tory government would "immediately" cancel the project.

As the Financial Times reports today, shadow home secretary David Davis also wrote to the government asking for that position to be taken into account when entering into contracts. (See here for the official announcement on the party's website.)

This is an interesting move. On the one hand, it increases the party politicisation of the privacy issue that I have speculated about in this blog in the past (see here and here). This is all the more so since the Tories are presently launching a web- and print-based campaign against ID cards. The main arguments put forward are that ID cards "won't work", "are a waste of money", and "an invasion of privacy". The campaign also includes an online petition to the Prime Minister "to scrap the proposed introduction of ID cards". (As of 6 February 2007, 16,143 signatures have been added).

On the other hand (and speaking as a political scientist), it is an interesting procedure for a weak opposition to try to exert influence on an all-powerful government. While most experts would at the moment probably think a hung parliament more likely than an outright Conservative majority in a future UK general election, it must hearten the Tories see firm announcements of what they will do once they return to power — whenever that may be…

Technorati Tags: owl-content, politics, privacy

German Federal Court of Justice bans state hacker attacks on computers

The German Federal Court of Justice — the highest appelate court in the country for civil and criminal cases — yesterday banned the online search of home and business computers of suspects by state agencies through specialised computer programs such as trojans, spyware, or specially programmed computer viruses.

The case before the Court concerned Germany's Federal Prosecutor who is investigating a terrorist suspect and had applied for permission to smuggle a specially designed program onto the suspects PC or laptop. The program would then search the computer and copy data to the prosecturing authorities. The Court ruled that such a procedure would substantially infringe a person's fundamental rights and had no basis in law. The thrust of the Court's decision is against the covert character of the search: while it can be unannounced, it cannot be secret. (The decision — in German, of course — is available online.)

The decision has triggered an intense political row. Germany's Interior Minister, Wolfgang Schäuble (CDU), immediately announced that he would table a bill that would create a legal basis for such covert online searches. In his view, such an instrument is indispensable in the fight against global terrorism that is using online media, and the head of Germany's Federal Criminal Police Office agrees, arguing that "99.9 per cent of the population in Germany would not be affected by this".

Schäuble's colleague, the Justice Minister Brigitte Zypries (SPD) was more cautious, calling for a measured approach in line with constitutional requirements. Since computers were used for many private things that authorities would then have access to, too, privacy rights might be violated substantially.

The opposition parties Greens and Left Party welcomed the Court's decision, while the Liberals stance was ambiguous: on the federal level (where they are in opposition), politicians like Jörg van Essen embraced the decision, stating that the Court had strengthened citizens' rights. Yet the state of North-Rhine Westfalia passed a bill only in December 2006 that allows covert online searches of computers. The minister in charge there is Ingo Wolf (FDP) who argued that this represents a "quantum leap".

If this is pursued further by politicians, it will be an interesting case to follow. The fight against terrorism has been used in the past couple of years in Germany to bring in substantial new powers for state agencies and prosecutors and curtail civil rights. Under the Schröder government, the Social Democrats were the driving force (with largely tacit acceptance by their small coalition partner The Greens), while the CDU's opposition waned and FDP opposition to infringement on civil rights grew. Now, the two parties which favour a "strong state" approach in law enforcement, the CDU and the SPD, are united in a Grand Coalition.

If you had to bet money, which do you think will succeed?

Technorati Tags: owl-content, politics, privacy

Germany's National Ethics Council publishes opinion on privacy and health information

Germany's National Ethics Council has published an opinion setting out guidelines about privacy rights and health information, warning against private health insurance companies demanding ever more detailed diagnostics from new customers.

The 55 page opinion (English language version probably soon available here) argues that private health insurance companies' desire to know ever more about their customers' current state of health before offering them protection has to be balanced against the individual's privacy rights. While the Council acknowledges that insurance companies have a legitimate interest to know about the risks they are taking on, it argues that individuals also have rights that must be protected. It is especially (but not only) modern genetic diagnostics that makes prediction of an individual's future health trajectory possible. While this information can be used to engage in preventative measures, it can also be used to exclude individuals from health insurance.

The Council thus argues that the amount of information requested must be proportional to the protection offered — for very high levels of insurance, higher information requirements are acceptable. Problems arise, however, if individuals seeking normal levels of protection are subjected to tests that may lead to information the individual would prefer not to have — such as knowledge about an incurable disease that will afflict them in the future. Individuals, the Council argues, also have a right to ignorance that must be taken into account. The Council links this to the "right to informational self-determination" established by the German Constitutional Court and consequently advocates restrictions on insurance companies' information requirements.

Social science analysis of insurance has always pointed out problems of information asymmetry and adverse selection. The Council's opinion (which has only consultative force) highlights the fact that these issues must be revisited and given special attention in the light of new diagnostic methods and information technology, and that individual rights must be carefully balanced against corporate (and state!) interests of cost reduction.

Technorati Tags: owl-content, privacy, politics

Support for civil liberties declines in the UK

Britons tend to think of themselves as the natural supporters of civil liberties, but as empirical research published today shows, support for them is waning in the face of terrorist threats.

The British Social Attitudes Survey, an annual survey that has been conducted for almost 25 years, shows that majorities of 70 to 80 per cent now see compulsory identity cards, longer police detention of terror suspects without charge and the phone tapping and tagging of terrorist suspects as a price worth paying for security, as the Financial Times writes today.

However, while, as one of the study's authors, Prof Gearty of the LSE, says, the "very mention of counter-terrorism makes people more willing to contemplate giving up their freedoms", it is worth noting that support for civil liberties has been eroding long before the present terrorist outrages on 9/11, 2001 in New York and 7/7, 2005 in London. To a considerable extent, this seems due to society forgetting just why civil liberties were considered important in the past. In Prof Gearty's words: People "know they should care" about civil liberties, "but cannot for the life of them articulate why".

Another interesting aspect of the survey (and linking nicely to the previous blog post mentioning an increasing party-politicisation of privacy issues) is that it is mostly Labour Party supporters' views that have changed on key issues such as police detention and identity cards, while Tory supporters are turning more to libertarian views.

Technorati Tags: owl-content, privacy

Britain: the privacy and surveillance debate broadens

First of all, a happy new year to all my readers! And apologies if this blog is currently being updated less often than in the past. Overload at work is one reason — the other is more positive and described in the first post of 2 November :-) Also, I am happy to report that page visits in 2006 were up about a third over those of the year before.

Perhaps this really is a sign for an increased interest in the topic of privacy by the general public. In line with the last post about the increasing discussion in Britain about privacy and surveillance, the magazine The Economist diagnoses in this week's issue that "the public wakes up to the surveillance society". In an article the magazine (known for its sober, no-nonsense and fact based reasoning) writes about

"development of extensive government and commercial databases—less visible, and so less noticeable—that is truly worrying. Britain leads the world here, too. Its police-run DNA database is the biggest anywhere; the government has plans to track and monitor all 11.7m children in the country; and a scheme for a £5.4 billion system of national-identity cards is under way."

Another interesting development is that the topic is slowly becoming party-politicized. The Tories under David Cameron have begun to pick up the popular discontent about privacy infringement, and are attacking the Labour government that is "eroding the privacy of law-abiding citizens", as Shadow Constitutional Affairs Secretary Oliver Heald put it last November in a reaction to the Information Commissioner's report mentioned in the last blog post:

"From plans for a national ID cards database, to chips in wheelie bins to check your rubbish, to council tax inspectors knocking on your door, its clear that under Labour the liberties and privacy of honest law-abiding citizens are being eroded."

On the more recent story mentioned above by The Economist about linking government databases together, Mr Heald warned

"that examples of 'Big Brother' intrusion included the detailed property database of every home being built by Gordon Brown's Valuation Office Agency in advance of council tax revaluation; Government plans for compulsory ID cards involving a series of databases; the Department for Education & Skills £224 million database of every child; the fitting of microchips in household dustbins in preparation for the introduction of new bin taxes; and the connection of local traffic cameras and CCTV to create a nationwide, real-time database to monitor every number plate in Britain."

David Cameron himself used a speech to the International Institute for Strategic Studies to warn of the dangers that the introduction of ID cards with their accompanying data infrastructure would pose to citizens privacy rights, particularly given the past record of failures in mega-sized government IT projects in the UK. (The speech is available here and here).

Given the Tories long-standing reputation for somewhat heavy-handed law-and-order policies, this may surprise some readers. But on the one hand Cameron is keen to demonstrate that the Tories have changed under his leadership; on the other hand this reflects to some degree the logic of Britain's two party system — once the other party has stolen your policies, you have to move towards their vacated position. Labour did the same in the past, for example, when they suddenly turned pro-European after Mrs Thatcher had abandoned her party's traditional position and turned against European integration in the late 1980s…

Technorati Tags: owl-content, privacy

Britain starts discussing privacy and surveillance

The UK is one of the countries with the greatest amount of surveillance taking place and consequently faces threats to its citizens' privacy. This is the gist of a report that the Office of the Information Commissioner has published today, on the occasion of hosting the 28th International Data Protection and Privacy Commissioners’ Conference in London.

The 102 page "Report on the Surveillance Society" has been written with the help of leading academics in the field, and it is supplemented by expert reports focusing in detail on specific areas such as Citizenship and Identity, Consumption and Profiling, Crime and Justice, Public Services, and Workplace Surveillance. Both reports can be downloaded from the Information Commissioner's website.

The report has created quite a bit of public attention, with the BBC reporting at length on it and the underlying topics and developments (see here), and the Daily Telegraph devoting more than two whole pages to it under the headline "Britain: the most spied nation in the world". The paper's leader links the developments to government action and thus politicises it:

"History will record that the most baleful legacy of New Labour is […] the way in which it has destroyed our privacy. We are the most spied-upon society in Europe, with more CCTV cameras than the rest of the EU combined. In the international rankings calculated by the human rights organisation Privacy International we are near the bottom of the table, marginally above Russia and China but below the Philippines and Thailand."

The article ends by calling upon Conservative Party leader David Cameron to "lead a full-throated and sustained attack on New Labour's surveillance society".

The report and its debate comes only a day after the Nuffield Council on Bioethics launched a public consultation exercise to draw the British public's attention to the fact that the National DNA Database currently holds more than 3.5 mio samples, and that 40000 citizens are added each month to the database. This makes the NDNAD by far the largest DNA database in the world. Since DNA contains a lot of information about each individual (which also means that comparing it to a fingerprint, while often done for convenience, is factually wrong), serious ethical, social and political questions are being raised by this. The consultation paper can be found online here, and comments are invited until 30 January 2007.

On the same day, the Guardian's headline read "Warning over privacy of 50m patient files", discussing the giant £12 bn NHS IT project that will make all patient health information centrally available — with access for law enforcement and security services, and without the right for the individual to withhold that information.

Might it be that we are presently witnessing the start of a comprehensive debate about the politics of privacy in the United Kingdom?

Technorati Tags: owl-content, privacy

Back at the blog

Hi — just to say that I am back blogging on privacy issues again. The Busch household has had a new member four weeks ago in the shape of little Benedict, and the start of the new academic year has demanded my attention. Apologies for not adding anything for two months!

And thanks to all my readers — the blog has see the number of its readers steadily increase over its lifetime, and page hits are up around 30 to 50 per cent over a year ago. About 46 per cent come from Europe, 44 per cent from North America, 4.5 per cent from Asia, and 2.2 per cent from Australia.

Technorati Tags: owl-content, privacy

Academic workshop on privacy at ECPR in Helsinki, May 2007

My ongoing academic interest in questions of the politics and governance of privacy has led me to team up with my colleague Charles Raab of Edinburgh University, one of the leading experts on the subject. Together we have developed the program for a workshop to be held at the next annual meeting of the European Consortium for Political Research (the European level political science association which, however, accepts departments from around the world for membership).

Charles was a pioneer in directing a workshop on the topic at ECPR some 25 years ago, so for him it is a coming back. Next year, our workshop will focus on "Privacy and Information: Modes of Regulation". We are interested in how recent technological developments — that increased personal data massively and made them cheaply storable and transferable — have challenged and altered the political regulation of privacy around the world. Issues such as biometrical passports, the establishment of DNA databases, the use of CCTV cameras in public space, and the use of RFID chips have spawned political debates in many countries as well as theoretical reflection.

We hope to attract good proposals from colleagues around the world who work on the issues of privacy and information policy from either a theoretical or empirical perspective, and we look forward to meeting with them and discussing their and our work in May next year.

You can find the leaflet with the detailed information and workshop abstracts here. If you are interested and have questions, feel free to contact me!

Technorati Tags: owl-content, privacy

Legal expertise: surrender of SWIFT financial data violated German and European data protection laws

After 9/11, the U.S. administration obtained massive amounts of data about financial transactions worldwide from a Belgian cooperative named SWIFT for the purpose of tracking terrorist financial flows (see a previous blog entry). Now a German data protection agency has published a legal opinion arguing that the surrender of the data to American authorities violated both German and European level data protection laws.

The agency in question is the "Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein" or ULD, an independent data protection agency in one of Germany's 16 federal states, operating under public law and acting as a promoter, protector, and auditor of data protection standards. It has long been at the forefront of the public debate on data protection issues in Germany (see its website here, in German language).

ULD argues that SWIFT (the Society for Worldwide Interbank Financial Telecommunication) acts as subcontractor to German (and other) banks who are therefore obliged to force SWIFT not to pass its data on to unauthorized others. Specifically, data concerning intra-European financial transactions must not be mirrored to SWIFT branches in the United States. ULD has asked German banks to report by the end of September about measures they have undertaken to fulfill their obligations.

The expert opinion can be found here (in German language).

In European business papers, concerns had been expressed that the data transmitted to the United States might be used for purposes of industrial espionage (see the German daily Handelsblatt report on 11 July 2006 here and the Austrian daily Die Presse on the same day here). The European Parliament on 6 July 2006 passed a resolution warning against such misuse of the data and strongly criticizing the U.S. action (see also here).

Technorati Tags: owl-content, privacy

If you're looking for a contract killer, use Google, not AOL…

…seems to be the lesson of the latest hiccup concerning data privacy on a big scale. What has happened?

As is widely reported (see the stories in the New York Times, on slashdot, or CNET), AOL released the search data of 658000 users on the internet — 20 mio searches done in the March to May 2006 period, or 0.3 per cent of all searches, overall 2 Gigabyte of data. While AOL user names have not been included, users have a unique identifier which makes it possible to identify the searches submitted by the same user. And since many people submit search terms that gives clues to their identity (so-called "vanity searches", e.g. for their own name, firm, or city), it may be possible to identify some of them.

This may be highly embarrassing, because many people are submitting searches for such unsavoury things as drugs, child porn, or a contract killer for their wife. Or they may reveal deep trouble — see some examples here.

Why has AOL published these data? For research purposes, and not for commercial use. Will spammers keep to these terms? You bet... Apparently the company now regards it as a mistake. The data were taken from the web and the spokesman has apologized.

Some interesting background: last August, the US administration subpoenaed AOL, Yahoo and Google for user data. But of the three companies, only Google chose to fight that order in the courts and won, earning lots of reputational brownie points on the way. So, are user's search data safer with Google than with AOL? Only time will tell.

The case, in my view, has the potential to be scandalized -- both by US lawmakers intent on regulating the internet more to fight evil use of it, and by civil rights campaigners who may call for European style data protection legislation regulating private sector use of data. But it could also spark new rows between the European Union and the US about data privacy.

Update: A website through which you can search and analyse the AOL user data has been set up for example here (there are also several others), and The New York Times has the story how they traced one of the users here. How did they find her? She had repeatedly looked for specific places in a small town in Georgia, searched for a name (which turned out to be also hers), and when asked by a reporter who had tracked her down admitted that the searches were hers. “My goodness, it’s my whole personal life,” she said. “I had no idea somebody was looking over my shoulder”, the NYT quotes her as saying.

Technorati Tags: owl-content, privacy

SWIFT affair: European data protection agencies join forces

In the affair about US appropriation of detailed data on world financial transactions from SWIFT — the Society for Worldwide Interbank Financial Telecommunication — after 9/11/2001 (see details in this blog entry), European data protection agencies have now decided to join forces. As the German data protection commissioner writes on his website, the so-called Article 29 group have decided to contact their respective banking organisations to find out about the extent and scope of surveillance and data transmission to the United States.

The commissioner (who is also presently the chair of the Article 29 group) points out that customers of all financial institutions have a right to know how their confidential data were being treated, for the processing of their data according to data protection rules is a fundamental right.

As a previous reaction to the SWIFT affair, on 6 July 2006 the European Parliament had adopted a resolution strongly disapproving of "any secret operations on EU territory that affect the privacy of EU citizens" and expressing its deep concern "that such operations should be taking place without the citizens of Europe and their parliamentary representation having been informed". Furthermore, the Parliament urged "the USA and its intelligence and security services to act in a spirit of good cooperation and notify their allies of any security operations they intend to carry out on EU territory".

Technorati Tags: owl-content, privacy

Data security — a bureaucracy's solution

Reacting to the recent problems (see here and here) about federal data getting lost, the US Office of Management and Budget (OMB) has now issued guidelines about how to protect sensitive agency information in the future. As the Washington Post reports, civilian agencies will have 45 days to implement the new measures which essentially are encryption of all movable data (on laptops and handheld computers) and keeping detailed records of all information downloaded from databases containing sensitive information.

The guidelines are available as a pdf document here, and they are instructive less for their substance (see above) than for the insight they provide into the workings of a bureaucracy's mindset: One page of instructions is followed by nine (!) pages of a security checklist that includes a flowchart, a checklist and excessively detailed prescriptions about procedures that I can only describe as mind-boggling...

Care for a snippet? Here is one chosen at random:

"Action item 2.3: Revise/develop organizational policy as needed, including steps 3 and 4.

Guidance: Based upon the results from the previous action items, the organizational policy is revised or developed to fully address the questions posed in the previous action items.

Related SP 800-53 controls and associated SP 800-53A assessment procedures:
AC-1 ACCESS CONTROL POLICY AND PROCEDURES
SP 800-53A: AC-1.1, AC-1.2, AC-1.3, AC-1.4 (for high impact add: AC-1.5, AC-1.6, AC-1.7)"

And this goes on page after page after page…

Update: Fiittingly, today it was announced that the stolen laptop with the soldiers' and veterans' data that triggered this all has been recovered (see CNN report here). Apparently there are have been no reports of identity thefts from the data concerned so far. And since much of the blame was initially put on the analyst from whose house the laptop was stolen, it is interesting to note that this employee apparently had approval dating back from 2002 to use the data with specially written software in his home. He now is challenging his dismissal from the Dept. of Veteran Affairs.

Technorati Tags: owl-content, privacy

US administration obtained international financial records in fight against terror

The Bush administration obtained records about financial transactions from a Belgian cooperative that routes money between international banks in an attempt to fight terrorists, the New York Times writes today in a big story. The Society for Worldwide Interbank Financial Telecommunication or SWIFT is described by the NYT as "the nerve center of the global banking industry" as it passes $6 trillion daily between banks, brokerages and stock exchanges.

After 9/11, the CIA subpoenaed SWIFT and initially obtained their whole database of transactions. After 2003, SWIFT managed to insist on there being SWIFT representatives present when records were analysed and to block searches they considered inappropriate.

While safeguards seem to have been imposed to protect against unwarranted searches of Americans' records, no such protection seems to exist for citizens of other countries. It also seems that American laws restricting government access to private financial records do not apply because SWIFT is considered a messenger service and not a bank or financial institution.

This case links to the Bush administration's other high tech snooping operation that came to light some six weeks ago, namely the NSA building up a giant database of phone calls in America (see the blog entry here). Whether any of these massive data mining operations have yielded valuable information against terrorists that could not have otherwise been obtained we do not know at this point. What we know for certain is that millions and millions of records containing private information have been obtained by government officials, and that the further uses these records will be put to are unknown. Will they get lost, like those of the Army veterans and currently serving personnel?

Update: In the meantime, SWIFT has published a statement on its compliance policy on its website, detailing the process from its point of view and emphasizing that its role was not voluntary. And the NYT reports that Vice-President Cheney has assailed the press for publishing the story, implying that this endangered US national security (a point strongly refuted by the NYT's executive editor). Cheney also described the administration's actions as "good, solid, sound programs" that are "absolutely essential in terms of protecting us against attacks". Privacy advocates like Privacy International's Simon Davies have complained that "our data has been effectively hijacked by the U.S. under cover of secret agreements and entirely undisclosed terms."

Technorati Tags: owl-content, privacy

The European Parliament: a pyrrhic victory on passenger name records?

It looks as if the European Parliament's much touted victory in the case of the US-EU agreement on passenger name record (PNR) transmission (see the blog entry from 3 weeks ago here) may turn out to be a pyrrhic one. The reason is that the European Commission has today adopted two initiatives that will renew the agreement, but under a procedure that excludes the European Parliament from the decision making (namely Art. 38 of Title VI of the Treaty on European Union for the Euro-experts among my readers).

Much as data protection aficionados will not like this, it is not a sinister move by the Commission. Rather, as the European Court had declared the legislation invalid under internal market rules, a new way had to be found, and that is now in the "intergovernmental" part of the European Union — the part where governments agree among themselves without participation from the European Parliament.

However, the Court did not pronounce on the compatibility of the PNR agreement with European level data protection legislation. It may thus be that a new attempt will be made to bring the agreement before the Court, disputing its substance. Since the Commission wants to keep the content of the agreement with the US as it stands at the moment, privacy action group lawyers can already sit down and start writing their briefs…

Technorati Tags: owl-content, privacy

US Army data loss also affects active soldiers

Two weeks ago it emerged that a laptop and an external hard disk containing the data of some 26 million US veterans had been stolen from the home of an employee in early May 2006. The employee had violated Department of Veteran Affairs rules in taking the data home. (See the blog posting covering that event here and the latest information from the US government here).

Now the US Department of Defense has announced that the hard drive may in addition have contained the data of as many as 1.1 million active-duty servicemembers, 430,000 National Guardsmen, and 645,000 members of the Reserves.

In the meantime, the political battle over legislation concerning the issue of identity theft continues. Interestingly, a bill before Congress (HR 3997) seems to weaken rather than strengthen consumer rights in this field.

Update: As the Washington Post writes, the data stolen cover nearly 80 per cent (!) of the active duty force. Using them would enable the targeting of service members and their families in the U.S. through ZIP codes, or on foreign travels. There is a $ 50,000 reward for information allowing authorities to recover the laptop. And apparently heads have been rolling in the Department of Veteran Affairs, including that of the employee (who had been taking data home for three years) and his boss. A class action suit has been filed, demanding $ 1,000 for each veteran affected. At 26 mio. records, this could become very expensive for the administration if successful!

It is still not known whether the burglars know of the nature of the data in their possession; however, I would assume that not only the law enforcement side is now urgently interested in this hard disk...

Technorati Tags: privacy

Passenger flight data: European court blocks EU data deal with US

The European Court of Justice has today anulled the European Council's decision regarding an agreement to provide US authorities with the data of European flight passengers, and the European Commission's decision that this agreement complies with with the European Union's data protection requirements. (More information about the details can be found in the ECJ's press release).

Such an outcome had been expected since the court's Advocate General had recommended the anulment in November of 2005 (see my respective posting on this blog).

Now both aforementioned institutions, the Council and the Commission, are left with the proverbial egg on their faces. This is a victory for the European Parliament which had brought the case before the court, arguing that the Commission was violating the European Union's own data protection legislation.

The full text of the ruling will soon be available here. The BBC, the New York Times, and SPIEGEL Online already have reports on this up.

Since the United States have threatened to withdraw landing rights from any airline not complying with the agreement, it will be interesting to watch further developments in this case. However, the ECJ has ruled that the agreement can stay in effect until 30 September 2006. I would expect intense negotiations to start now between the EU and the US…

Technorati Tags: privacy

German constitutional court declares dragnet searches unconstitutional

The German Federal Constitutional Court (FCC) yesterday ruled that dragnet searches through through databases are unconstitutional if there is no concrete danger involved.

After 9/11, authorities in the German state of Northrhine Westphalia had initiated such a search to track down "sleepers" who might become Islamist terrorists. University student databases were used as well as communal registration office data and the central database of foreigners. Criteria used included male gender, age between 18 and 40, present or former enrollment in higher education, Islamic faith, and country of birth. The persons who met these criteria (apparently some 32000) were then investigated further by the local policy forces. No "sleepers" were detected as a result of this exercise. (A German language press release from the FCC is here, an International Herald Tribune summary here, Deutsche Welle English language service has it here).

A Moroccan student (at the time) of Islamic faith complained against having been subjected to this procedure, and took his case all the way to the FCC which eventually ruled in his favour. The Court ruled that the dragnet search had violated the student's "right to informational self-determination", a right the Court had developed from the Basic Law (the German constitution) some twenty five years ago. The Court ruled further that a dragnet search was such an intrusion to the student's fundamental rights that it would only be admissible if there was a concrete danger. While this could in principle also apply to the case of a terrorist threat, more concrete information about the threat was required than had been present in the post-9/11 dragnet searches.

The ruling has met different echoes in German political life. While Bavarian interior minister Beckstein (a law-and-order supporter) called it "a black day in the fight against terrorism", civil rights groups and the liberal press have praised the FCC for upholding civil rights that have been under threat in recent years. The latter also pointed out that dragnet searches like this can lead to hysteria as whole groups of the population are sweepingly suspected of presenting a terrorist danger.

Technorati Tags: owl-content, privacy

If you're a US veteran, your data have been stolen

Bad news for some 26 million US veterans: their names, Social Security numbers and birth dates are among the data that were compromised when a laptop with an external drive was stolen in Maryland some three weeks ago. Identity theft on a gigantic scale now is another problem the US armed forces have to worry about.

As the Department of Veteran Affairs announces on its website, an employee took the data home (a violation of the Department's policy), and his home was burglarized. As CNN reports, the loss was kept secret for three weeks in order not to alert the thieves of the content of their booty, fearing that they might then try to sell it to interested parties.

Some 26.5 million veterans and some of their spouses are concerned, apparently every living veteran discharged between 1975 and the present. The Department has set up a major information operation, including a call centre, to provide information. The call centre can handle up to 260000 calls per day, so if everyone calls — well, you can do the maths for yourself.

Law makers have expressed concern about the stolen data. As the New York Times writes, the problem is that the data concerned may enable the thief "to begin trying to open new accounts, secure loans, buy property and otherwise wreak havoc on the victim's credit history."

As regular readers of this blog will know, this is only the latest in a long string of incidents of major data theft, including as victims US firm ChoicePoint, Lexis-Nexis subsidiary Seisint, Bank of America, Retail Ventures subsidiary DSW Shoe Warehouse, the hotel chain Marriott, and the Pentagon.

Technorati Tags: privacy