Feeds

US outlines privacy safeguards – and reveals plans to mine personal data

'Invasive and unprecedented'

Beginner's guide to SSL certificates

The US Government signalled some willingness this week to address concerns over citizens' privacy, but also launched a scheme which will analyse secret airline passenger risk profiles and keep them for 40 years.

The US Government released guidelines which it says will protect the privacy of US citizens in an era of increasing data collection and information sharing by and between Government bodies.

Congress had previously mandated greater information sharing within government and law enforcement, but there have been concerns that that process undermines individuals' privacy.

The office of the US intelligence chief John Negroponte has now released a set of guidelines for state agencies to follow in dealing with individuals' data.

The guidelines say that Government bodies must ensure that information is being gathered lawfully and that sharing with other bodies is legal. Information can only be shared if it is to do with homeland security, terrorism or law enforcement, they say.

"Protected information should be shared through the Information Sharing Environment (ISE) only if it is terrorism information, homeland security information, or law enforcement information," said the guidelines. "Each agency shall adopt internal policies and procedures requiring it to ensure that the agency’s access to and use of protected information available through the ISE is consistent with the authorized purpose of the ISE."

Meanwhile, however, the US Government began a planned scheme this week which creates risk assessments of airline passengers, assessments that passengers can never see and which are kept on file for 40 years.

A programme has been identified by digital rights group the Electronic Frontier Foundation (EFF) which collects information about individuals, stores it in a database and performs a risk assessment about whether or not the individuals concerned are likely to break US law.

"Personally identifiable information is collected to ensure that people and cargo entering or exiting the United States comply with all applicable US laws," said a privacy impact report on the Automatic Targeting Scheme (ATS). "Relevant data, including personally identifiable information, is necessary for CBP to assess effectively and efficiently the risk and/or threat posed by a person, a conveyance operated by person, or cargo handled by a person, entering or exiting the country."

Information will be gathered and stored on US citizens and foreigners, including EU citizens. A major source of data will be passenger name records (PNR), themselves the subject of data protection controversy in Europe.

The US has agreed a controversial deal with the European Commission to allow airlines to pass 34 pieces of information to US authorities every time an EU citizen flies into the US. The European Parliament opposed the deal, as did privacy activists, in part because US data protection is weaker than that in the EU.

"Generally, data maintained specifically by ATS will be retained for up to forty years," said the ATS privacy report. "Certain data maintained in ATS may be subject to other retention limitations pursuant to applicable arrangements."

European PNS data will not be kept for as long as 40 years, said the report, because of the conditions of its transferral.

The EFF says that the system is invasive and unprecedented. "The government is preparing to give millions of law-abiding citizens 'risk assessment' scores that will follow them throughout their lives," said EFF Senior Counsel David Sobel. "If that wasn't frightening enough, none of us will have the ability to know our own score, or to challenge it. Homeland Security needs to delay the deployment of this system and allow for an informed public debate on this dangerous proposal."

Copyright © 2006, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.