More on anonymous annoyances

Many of the blogs I follow were abuzz yesterday with discussion of the Declan McCullagh column on CNet News entitled "Create an e-annoyance, go to jail". (I wrote about it here: "Anonymous 'net annoyers headed to jail".)

There are widely divergent opinions all over the 'net on what this poorly drafted provision actually means. Some suggest that it attacks all anonymous speech that is annyoing, including blog postings and comments. Others suggest that it is very restricted and might not even cover e-mail. Some discussions worth checking out:

• Boing Boing: Flame someone anonymously, go to jail? No, say BB-reading lawyers - Boing Boing printed comments from a number of readers, including me and Daniel Solove (see below).
• Concurring Opinions: Annoy someone online (anonymously); go to jail, which includes a comment from Daniel Solove and a dozens of others.
• Kip Eqsuire: A Stitch in Haste New VAWA "Annoying" Clause is Indeed Annoying -- But Not to Blogs
• SIVACRACY.NET: Anonymous Trolls Beware?
• Slashdot Crank Blogging, Like Phone Calling, Now Illegal

The original McCullagh article is also followed by a bunch of reader comments, so check that out too.

Technorati tags: [Anonymity] :: [First Amendment] :: [Specter] :: [Law] :: [Privacy] :: [Cyber Stalking]

Incident: County clerk accidentally releases SSNs of election officials

A minor incident: A county clerk in Rockford, IL has apologized after releasing a list of election officials without blacking out the social security numbers, presumably in response to an Freedom of Information request. The unwitting recipient of the information is a little upset. See: AP Wire | 01/10/2006 | Winnebago County Clerk apologizes for releasing personal information

Technorati tags: [Incident] :: [Privacy] :: [Freedom of Information] :: [Illinois] :: [Incident] [Social Security Number]

Behind the curtain: Why retailers ask for your personal information and what they do with it

The Saginaw News ran an interesting feature-length article in its Sunday edition about privacy in the retail system. It touches on loyalty programs, RFID, advertising and security of personal information. And it is balanced, with good comments from both business and privacy activists. Check it out: A peek into your privacy: Retailers increasingly ask for personal information.

[Personal Information] :: [Privacy] :: [Retail]

Incident: Hotel registration cards found in dumpster in UK

A five star hotel in Brighton, UK, has switched into damage control mode after a passer-by found loads of customer registration cards in the a dumpster. The cards had names, addresses, signatures and valid credit card numbers. The BBC notes that the hotel often hosts high profile conferences and the details of some Members of Parliament were on cards found. See: BBC NEWS | England | Southern Counties | Private hotel cards found in skip.

[United Kingdom] :: [Privacy] :: [Security] :: [Personal Information] :: [Identity Theft] :: [Security Incident] :: [Privacy Incident]

Movie website raises privacy issues by use of age verification system

Be prepared to fork over your personal information if you visit the website for "Grandma's Boy", an upcoming movie from 20th Century Fox. If you want to see the film's trailer, view clips and enter to win fabulous prizes, be prepared to fork over your name, date of birth and zip code. That's what it says on the front page, and there's no privacy policy link to tell you what the website will do with it. No notice. Nothing. Nada. Zilch.

According to DM News and New York Newsday, the site takes your data and matches it against a huge database compiled from US drivers' licenses. If your details match, you get in.

Once you get in, you can then read the 20th Century Fox privacy policy, which seems to say they'll never do what they just did. Read on:

Effective as of July 1, 2005

PRIVACY POLICY

...

2. NOTICE - FOX FE WILL PROVIDE YOU WITH NOTICE ABOUT ITS PII COLLECTION PRACTICES:

When you voluntarily provide PII to Fox FE, we will make sure you are informed about who is collecting the information, how and why the information is being collected and the types of uses Fox FE will make of the information.

At the time you provide your PII, Fox FE will notify you of your options regarding our use of your PII, including whether we will share it with outside companies (See "Choice" below). This Policy describes the types of other companies that may want to send you information about their products and services and therefore want to share your personal information, provided you have given Fox FE permission to do so (See "Use" below).

Sometimes we collect PII from consumers in manual format or off-line, such as a post card or subscription form. Providing detailed notice in those situations often proves impractical, so consumers will instead be provided with a short notice that describes how to obtain the full text of this Policy and other relevant information from us.

...

3. CHOICE - FOX FE WILL PROVIDE YOU WITH CHOICES ABOUT THE USE OF YOUR PII:

Fox FE will not use the PII you provide to us for purposes different from the purpose for which it was submitted, or share your PII with third parties that are not affiliated with Fox FE (i.e., not a part of the News America Group), unless we obtain your permission.

...

7. REMEDIES AND COMPLIANCE - HOW TO CONTACT FOX FE ABOUT PRIVACY CONCERNS:

If you have any issues or complaints regarding this Privacy Policy, please contact:

Foxmovies.com Privacy Officer
P.O. Box 900
Beverly Hills, CA 90212

(888) 369-0687

feedbackus@fox.com

© 2005 Twentieth Century Fox. All Rights Reserved.

It's enough that there is no notice on at the time that very personal information is collected, but there is no mention anywhere what would be done with the info. Is is kept? Where does it go? Is it matched to anything else collected by the company or anyone else? It is so easy to just tell people why the information is being collected and what will be done with it.

Age verification may be a reasonable purpose to collect information like this, but doing it without notice or any reassurance makes it very easy for others (perhaps less reputable others) to follow suit. People may simply get more used to handing over sensitive personal information without knowing where it is going.

As an aside, I'm not sure how well their system works. Just try John Smith, 03/03/1970 living in Beverly Hills 90210.

[Movies] :: [Privacy] :: [Security] :: [Personal Information] :: [Identity Theft] :: [Anonymity]

Anonymous 'net annoyers headed to jail

Declan McCullagh at CNet has a very interesting article (Create an e-annoyance, go to jail Perspectives CNET News.com) on a new bill that has recently been signed into law in the United States. HR 3402, titled an Act to authorize appropriations for the Department of Justice for fiscal years 2006 through 2009, and for other purposes (emphasis on the "for other purposes") just became law. It is otherwise a standard appropriations bill that renews funding for the federal Department of Justice, except Senator Arlen Spector added a little bit of additional law for good measure. The provision, that in an earlier incarnation was meant to address anonymous stalking and harassing, has the potential for making it a crime to anonymously use the internet to merely annoy somebody.

If you take a look at the bill as passed, you can't find the "annoying part", but it comes from the way it amends an existing telephone harassment law (US CODE: Title 47,223. Obscene or harassing telephone calls in the District of Columbia or in interstate or foreign communications). As amended, that section will look like this:

(a)        Prohibited acts generally

Whoever—

(1)        in interstate or foreign communications— ...

(C) makes a telephone call or utilizes a telecommunications device, whether or not conversation or communication ensues, without disclosing his identity and with intent to annoy, abuse, threaten, or harass any person at the called number or who receives the communications;

…

shall be fined under title 18 or imprisoned not more than two years, or both.

…

(h)        Definitions

For purposes of this section—

(1)        The use of the term “telecommunications device” in this section—

(A)       shall not impose new obligations on broadcasting station licensees and cable operators covered by obscenity and indecency provisions elsewhere in this chapter; and

(B)       does not include an interactive computer service. ; and

(C)       in the case of subparagraph (C) of subsection (a)(1), includes any device or software that can be used to originate telecommunications or other types of communications that are transmitted, in whole or in part, by the Internet (as such term is defined in section 1104 of the Internet Tax Freedom Act (47 U.S.C. 151 note)).'.

[Corrected - see below]

As you can guess, more than a few people are up in arms about this. Just google "annoy declan" and you'll get at least seventy results.

UPDATE: Thanks to an astute commenter (thanks, Sean) who noticed that I had printed subparagraph (A) and not (C), I've corrected it above. It originally read:

(a)        Prohibited acts generally

Whoever—

(1)        in interstate or foreign communications—

(A)       by means of a telecommunications device knowingly—

(i)         makes, creates, or solicits, and

(ii)        initiates the transmission of,

any comment, request, suggestion, proposal, image, or other communication which is obscene, lewd, lascivious, filthy, or indecent, with intent to annoy, abuse, threaten, or harass another person;

…

shall be fined under title 18 or imprisoned not more than two years, or both.

[Snip]

[Anonymity] :: [First Amendment] :: [Specter] :: [Law] :: [Privacy]

Crystal ball gazing for 2006: Geist

Michael Geist recenly gazed into his crystal ball and has made some predictions for technology law in 2006. Here's what he said about privacy and security:

TheStar.com - Geist: Tech laws we need

Privacy and Security

The privacy law we need: 2005 was labelled the worst year ever for security breaches, with more than 50 million people in North America directly affected by the dozens of breaches that placed their personal information at risk. The growing awareness of security vulnerabilities stems from U.S. laws that compel companies to inform customers that their information was subject to a breach. Similar legislation is needed in Canada.

The privacy law we will get: The government introduced its so-called "lawful access" package last fall. The expression "lawful access" sounds benign; the goal isn't. It would give intrusive new powers of surveillance to law-enforcement authorities without needed judicial oversight.

Canadians can expect to see it revived whichever party forms the next government. While lawful access is better characterized as anti-privacy legislation, its re-emergence will force the privacy community to rally around appropriate oversights to guard against privacy abuse.

[Privacy] :: [Predictions] :: [Privacy Law] :: [PIPEDA] :: [Canada]

China to adopt privacy law

According to China Radio International, China is on the verge of adopting a general privacy law to protect citizens from "theft of information" and other such things:

China CRIENGLISH

China Drafts Law to Protect Personal Information

The State Council, China's Cabinet, has launched legislation procedures on personal information protection law in a bid to better safeguard citizens' privacy.

Media reports said a Chinese website publicly put nine thousand pieces of detailed personal data on sale, causing widespread social concern. The disclosure of private phone numbers, home and work place addresses and financial records seriously infringes on the privacy and life of the general public.

The current draft stipulates that personal information, as a part of a person's right of privacy, is a citizen's "intangible property", and those who steal other's personal information for financial gain are in violation of the law and shall be dully [sic]punished.

[Privacy] :: [China] :: [Privacy Law] :: [Identity Theft] :: [Personal Information]

Homeland Security opening private mail

MSNBC is reporting that a retired professor in the US is shocked that a recent letter from a regular correspondent in the Phillipines was opened and examined by the Department of Homeland Security. The letter arrived with a piece of green tape on it, indicating that the letter was opened "by Border Protection." I don't think this is a new phenomenon, but is being reported on in the wake of the warrantless wiretap scandal in the US.

One thing I find interesting from the story is that the retired professor used to do the same sort of "mail inspection" during the war:

Goodman is no stranger to mail snooping; as an officer during World War II he was responsible for reading all outgoing mail of the men in his command and censoring any passages that might provide clues as to his unit’s position. “But we didn’t do it as clumsily as they’ve done it, I can tell you that,” Goodman noted, with no small amount of irony in his voice. “Isn’t it funny that this doesn’t appear to be any kind of surreptitious effort here,” he said.

Would he prefer that this be hidden?

Read the MSNBC article here: Homeland Security opening private mail - U.S. Security - MSNBC.com.

Privacy :: Homeland Security :: Mail :: National Security

More on Minnesota's privacy politics

I've blogged recently about the current debate over privacy and identity theft in Minnesota. Here's some more on what's going on in this midwest state:

Governor Pawlenty is proposing to use biometrics to make drivers licenses more secure, which Attorney General Hatch wants the state to stop selling DMV records in bulk. The Governor is also proposing other reforms:

These include stiffening penalties for unauthorized access to personal data, going after hackers who secretly gain access to private data but don’t steal, making it unlawful to use encryption to hide a crime.

Ranging afield, Pawlenty argued that current state data practice law is flawed and upsidedown— data presumed private unless deemed public, he explained.

I find this fascinating to watch. This situation is the first time that I can think of that privacy and the protection of personal information has been a significant issue in a political debate. (Both are running for the governorship.) For some of the most recent news, see: Minnesota needs to do more to crack down on identity theives, says Gov. Pawlenty.

[Privacy] :: [Identity Theft] :: [Politics] :: [Minnesota]