CONTENTS

[1] Newsletter Highlights
[2] Washington Post Notes Key Voter Database Issues
[3] A Framework for Addressing Surveillance
[4] EDUCAUSE on IT Workforce in Higher Education
[5] Google Books’ Copyright Settlement
[6] Federal Trade Commission Chairman Speaks on Internet Privacy
[7] GAO Reports that Social Security Numbers are Widely Available
[8] About USACM

[An archive of all previous editions of Washington Update is available at
http://www.acm.org/usacm/update/]
(more…)

The Computers, Freedom and Privacy (CFP) Conference recently issued the call for proposals for its 19th conference, slated for June 1-4, 2009 in the Washington, D.C. area. Proposals are due December 19, 2008.

The conference organizers intend to take advantage of the new administration and conference location to shape their agenda. From the conference web page:
(more…)

Early on Election Day morning (at 1:16 AM) George Mason University’s e-mail system sent out a message to students under the Provost’s name stating that the Election Day had been moved to November 5. Here is the text of the message:

At 8:08 AM the Provost’s Office sent out a correction message titled “Urgent Voting Information":

As of Fall 2007 (latest available data on GMU’s website), total enrollment at GMU was 30,332. It is not clear how many students received this message.

Based on a very, very preliminary analysis by some of USACM’s members, it appears that the original e-mail was forged. E-mails can be forged if the SMTP (Simple Mail Transfer Protocol) mail server does not require adequate authentication. See CERT’s website on e-mail forging for more information.

Obviously this is a very serious issue and likely violates several federal and state laws. The Electronic Privacy Information Center just released a report on deceptive electronic campaign practices. This incident seems to fit squarely into the issues raised by that report.

Just to be clear, today, November 4, is Election Day for the United States. We encourage all eligible voters to get out and vote.

According to the Government Accountability Office (GAO), many bulk and online public records contain Social Security Numbers (SSNs), exposing many people to an increased risk of identity theft. Responding to a request from Senator Charles Schumer, the GAO prepared a report addressing the following concerns:

• (1) to what extent, for what reasons, and to whom are public records that may contain SSNs available for bulk purchase and online, and
• (2) what measures have been taken to protect SSNs that may be contained
  in these records

The GAO sampled state and local government and business records practices and determined the following estimates:
(more…)

This morning Google announced the settlement of a lawsuit brought against them by the Authors Guild and the Association of American Publishers over their Book Search technology. Google launched this product several years ago, which indexes books that Google scans from partnering university libraries. Book Search allowed full access to out-of-copyright material and snippets of works that were still copyrighted. It quickly became a controversial topic in the copyright wars as publishers claimed that the snippets were still a violation of copyright. Google claimed it was a Fair Use of the works because the full text was still protected and that it greatly enhanced the public’s access to these materials. Here is a summary of the agreement from their press release:
(more…)

William Kovacic, Chairman of the Federal Trade Commission, appeared on C-SPAN’s The Communicators recently to discuss the Internet and privacy policy. The audio podcast is available online as well as a video clip - which appears to be Mac-unfriendly.

It’s a wide-ranging discussion on many internet issues with one of the two agency heads (the other being the Federal Communications Commission) most responsible for monitoring and regulating Internet activity. Chairman Kovacic does a good job discussing the basics of internet tracking and aggregation - how sites can collect information on your web-surfing activity in order to target advertising. That’s in the first part of the broadcast. Discussion shifts to spam and other concerns such as internet infrastructure, social engineering, identity theft and mobile marketing. Those who are already well versed in these issues will probably want to focus on the first 10 minutes or so of the broadcast.

Saturday’s Washington Post detailed growing concerns and political battles over the implementation of new voter registration procedures as states use newly constituted statewide voter registration databases. One of the most difficult issues to resolve is the “no match” problem when state voter registration databases are compared against federal databases (such as the Social Security Number database) or other state databases. Matching problems occur when there are typos in entries, outdated data is used or there are just plain errors in the information. Depending on how tightly the state interprets no match problems, eligible voters might be dropped from voting rolls. While dropped voters are supposed to be notified, voters may not have enough of a window to file a protest if the automatic merging and purging occurs too close to an election.

This issue was raised in USACM’s 2006 report on statewide voter registration databases. The report made about 100 recommendations and spoke specifically to the no match issue:

According to the Washington Post article, 31 states are actively using their statewide databases for the first time in this election. This, combined with the anticipated heavy voter turnout, means the November election will be critical test of these systems.

While ACM has focused on Information Technology workforce issues, we have rarely had the opportunity to look at specific sectors in detail. EDUCAUSE is focused on Information Technology in higher education, and I want to note a recently released study their research center conducted on the IT workforce in higher education.

Leading the IT Workforce in Higher Education follows a 2004 EDUCAUSE report and combines interviews, surveys, and a literature review in assessing the leadership of information technology (defined as senior IT leaders, whether or not they aspired to be Chief Information Officers {CIOs} or not) in the higher education sector. It’s also a bit expensive, so I’m relating some of the key findings from a summary available from EDUCAUSE, instead of the full report. Keep in mind that the findings reflect those who responded to the survey (3,100 out of 19,787 who received surveys)
(more…)

Calling on the Executive and Legislative branches of the U.S. Government to “systematically” review every counterterrorism program that deals with personal data and establish new privacy protections, the National Academies recently released a new report examining counterterrorism efforts and privacy rights. In usual academies fashion, the report is a tome. The august body convened a distinguished and diverse panel to produce a comprehensive report that lays out the entire context of discussion, makes recommendations, and offers a detailed framework for reviewing counterterrorism programs.

It makes two overarching recommendations:

• U.S. government agencies should be required to follow a systematic process to evaluate the effectiveness, lawfulness, and consistency with U.S. values of every information-based program, whether classified or unclassified, for detecting and countering terrorists before it can be deployed, and periodically thereafter.
• The U.S. government should periodically review the nation’s laws, policies, and procedures that protect individuals’ private information for relevance and effectiveness in light of changing technologies and circumstances. In particular, Congress should reexamine existing law to consider how privacy should be protected in the context of information-based programs (e.g., data mining) for counterterrorism.

(more…)

October 15

Panel Discussion
The Election Assistance Commission will hold a panel discussion on issues facing election officials and journalists in reporting election results.
1 p.m., National Press Club, 529 14th Street N.W., Washington, D.C.

CONTENTS

[1] Newsletter Highlights
[2] Federal Investigators Criticize Voting Testing Lab Certification
[3] Congress Punts Again on Science Funding
[4] Congress Strengthens Cybercrime Enforcement
[5] Congress Targets Intellectual Property Infringers
[6] About USACM

[An archive of all previous editions of Washington Update is available at
http://www.acm.org/usacm/update/]
(more…)

In a sign that Congress isn’t focused exclusively on rescue plans, both houses recently passed the PRO-IP Act, legislation intended to fight copyright infringement and counterfeiting. The bill was championed by content providers, with some objections from non-profit and library groups, who would likely be caught up in the implementation of the law. Their opposition was likely a major influence on removing parts of the legislation that would have obligated the Attorney General to handle civil enforcement of copyright violations, something traditionally left to private parties.

The bill primarily increases penalties for copyright infringement and copyright counterfeiting (this would include penalties for trafficking in counterfeit goods). Some violations now have criminal penalties, including forfeiture, and other crimes have been elevated to felonies. Additionally, the bill establishes an Intellectual Property Enforcement Coordinator (IPEC) within the Executive Office of the President. The IPEC will develop a Joint Strategic Plan for IP enforcement and chair an interagency intellectual property enforcement advisory group. Other provisions allow for federal grants to support local law enforcement and other work to improve the tracking and enforcement of copyright piracy.

Other intellectual property bills are in process, but it’s unclear with the current legislative priority whether they will be resolved now, or in the next Congress.

An important part of crafting useful privacy policies is being informed by the best research available. To that end, organizations like The Privacy Place have focused on researching privacy questions and providing that information to the public. It’s a research center, and its work is sponsored in part by North Carolina State University and the National Science Foundation.

The Privacy Place is currently conducting a survey about user values and privacy policies. It won’t take terribly long to complete, and there are prizes available. Please connect to the survey and complete it.

While most attention is focused on the economic bailout proposals debated in Congress, other legislative activity is worth noting. Congress is supposed to break later this week for a campaign-related recess. It is unclear whether a post-election legislative session will be called. It was not following the 2006 elections, which resulted in a shift in Congressional control. It is possible that whoever the next President is would welcome a post-election session, but it is more likely that they would prefer things wait for January and their swearing-in.

First, as Peter Harsha has described at the Computing Research Policy blog, the new budgetary process is to finance the first part of fiscal years with continuing resolutions (CR). Besides a failure of basic job responsibilities, this pattern now means that proposed budget increases are either postponed or erased, as CRs will fund the government at the levels of the previous fiscal year.
(more…)

A bill awaits Presidential signature that would strengthen prosecution and penalties for identity theft and other cybercrimes. Tucked into another bill (HR 5938) that extends Secret Service protection for former vice presidents, it should become law soon.

This bill will institute federal civil and criminal penalties for various cybercrimes, including cyberextortion and conspiracy to commit cybercrimes. Penalties for existing federal cybercrimes will be added and/or strengthened, including criminal forfeiture (where the guilty party must forfeit both the proceeds of the crime and the equipment used to commit that crime), and an expansion of restitution to include compensation for the time spent recovering the stolen identity.

Two important changes cover unintentional holes in federal protection against identity theft. The law would include intrastate (within the state) cases of identity theft, as well as theft of an organization’s identity. Neither kind of identity theft is currently covered under federal law.

Full details of the cybercrime provisions can be found in Title II of the bill.

While not an advancement of U.S. law in the area of cybercrime, this bill will help tighten federal law. As sometimes happens when law is applied to new areas of technology (or new areas of crime), what worked for the closest legal analogue doesn’t quite work for the new area. With the passage of this bill, identity theft and other cybercrimes will have stiffer penalties, and cover more fraudulent online activity. Now if only catching the criminals were as easy.

September 24
Hearing:
The Senate Veterans Affairs Committee will hold a hearing on information technology cooperation between the Department of Defense and the Department of Veterans Affairs.
9:30 a.m., 418 Russell Building

Joint Hearing:
The Elections Subcommittee of the Committee on House Administration and the Constitution, Civil Rights and Civil Liberties Subcommittee of the House Judiciary Committee will hold a joint hearing on efforts to prepare for the 2008 election.
10 a.m., 2141 Rayburn Building

September 25
Hearing:
The Senate Commerce, Science and Transportation Committee will hold a hearing on broadband providers and privacy.
10 a.m., 253 Russell Building

The Senate Rules and Administration Committee will hold a hearing on nominations for the Election Assistance Commission.
2:30 p.m., 301 Russell Building