GEN 110-02 - Freshman Seminar: Computers and Society

Dr. R. M. Siegfried

Privacy

The Value of Privacy

The Constitution and the Right to Privacy

Fourth Amendment

The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, shall not be violated; and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the person or things to be seized.

Fifth Amendment

No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

Olmstead v. the United States

Olmstead was arrested and convicted of conspiring to "import, possess and sell liquor" during Prohibition. The basis of the conviction was wiretap evidence. The Supreme Court ruled that Olmstead’s fourth and fifth amendment rights were not violated because he was not coerced and with the wiretap being placed outside his home, there was no unreasonable search or seizure.

"The makers of our Constitution undertook to secure conditions favorable to the pursuit of happiness... They conferred, as against the government, the right to be let alone ... the most comprehensive of rights and the right most valued by civilized men." -- Justice Louis Brandeis in his dissent on Olmstead v. U. S.

Katz v. the United States

Acting on a suspicion that Katz was transmitting gambling information over the phone to clients in other states, Federal agents attached an eavesdropping device to the outside of a public phone booth used by Katz. Based on recordings of his end of the conversations, Katz was convicted under an eight-count indictment for the illegal transmission of wagering information from Los Angeles to Boston and Miami. On appeal, Katz challenged his conviction arguing that the recordings could not be used as evidence against him. The Court of Appeals rejected this point, noting the absence of a physical intrusion into the phone booth itself.

The Case presented the question:Does the Fourth Amendment protection against unreasonable searches and seizures require the police to obtain a search warrant in order to wiretap a public pay phone?

The conclusion is yes. The Court ruled that Katz was entitled to Fourth Amendment protection for his conversations and that a physical intrusion into the area he occupied was unnecessary to bring the Amendment into play. "The Fourth Amendment protects people, not places," wrote Justice Potter Stewart for the Court. A concurring opinion by John Marshall Harlan introduced the idea of a 'reasonable' expectation of Fourth Amendment protection. [http://www.oyez.org/oyez/resource/case/198]

Is Privacy Possible In the 21st Century?

Every breath you take, every move you make
Every bond you break, every step you take,
Every single day, every word you say,
Every night you stay, I’ll be watching you,
Every vow you break, every smile you fake,
Every claim you claim, ... I’ll be watching you.

Gary T. Marx (recorded by the Police)

"There is no more privacy get over it!" - Scott McNealy, CEO Sun Microsystems

Computers and The Violation of Privacy

Living in an era where computers are ubiquitous and highly interconnected, it is extremely difficult to keep secrets from the public. A thirty-minute search revealed the name and photograph of Kobe Bryant’s accuser. A ten-minute search revealed the name of the Chicago Cubs fan who knocked away a foul fly ball that was a factor in the Cub’s failing to win the 2003 National League Championship. A two-minute search revealed the name of the underage attackers in the Mepham High School Hazing Scandal.

National Databases?

Criminal History Databases?

In 1967, the FBI established the National Crime Information Center to maintain computer-based files on missing persons, warrants, stolen property, securities, criminal histories, and registered property (including guns, vehicles, etc.). As of 1994, the NCIC had a $6,000,000 annual budget and 8,000,000 personal dossiers (approximately one out of every 30 Americans) with the number growing to 90% of Americans with arrest records. This comes to about 35,000,000 – 40% of the workforce.

In 1986, when the FBI considered constructing a national computerized criminal history system, Kenneth Laudon wrote regarding it:

The significance of a national CCH extends beyond the treatment of persons with a prior criminal record. Creating a single system is a multijurisdictional, multiorganizational effort which requires linking more than 500,000 workers, thousands of governmental agencies, and private employers, from the local school district to the Bank of America, who will use the system for employment screening.Kenneth C. Laudon, Dossier Society: Value Choices in the Design of National Information Systems, Columbia University Press, 1986, , p. 16.

Criminal Database Disaster Stories:

Public Records for Sales

There is a variety of public records that are readily available for sale over the Internet. Many of these records are freely available and published in newspapers, but the Internet has made it infinitely easier to find them. These include:

There are two national phone directories available over the Internet (http://anywho.com and http://www.switchboard.com ), both of which contains links to e-businesses that sell public record data on individuals.

Web searches can provide information about on a large people variety of people. These can provide information about company employees, college and university faculty, administrators, and students, people involved in community organizations and so on.

Computerized Credit

Most adults in the U. S. use credits cards and banks loans to buy everything from groceries to motor vehicles to homes. All of this leaves a trail in consumers' credit histories. While credits records are supposed to be private, very little of this is actually private. All the user needs is a name and social security number, although for a credit search to be legal, it also requires written permission of the creditholder. There are three credit bureaus (Experian - formerly TRW of Allen Texas, Equifax Credit information Services of Atlanta and Trans Union of Springfield, PA). Consumers are usually advised to check their credit reports regularly to ensure that there is no erroneous information.

Caller ID

Caller ID is available in most states (including New York) and is generally considered a great convenience. But there are states like California that prohibit it and states like New York that allow blocking it on all calls or per call. Computer Professional for Social Responsibility say that "Caller ID, for example, reduced the privacy of telephone customers and was opposed by consumers and state regulators."

In New York, dialing *66 will call back whoever last dialed you and dialing *67 will block Caller ID display for a phone call. Why would someone want these features? In the following cases, Caller ID is more than an inconvenience:

Computer Matching - Is It Legal? Is It Moral?

Computer matching involves combining information from several different databases to look for patterns (of fraud, criminal activities, etc.). The Reagan Administration used this to "fight waste, fraud and abuse." (Welfare programs were the main target), but another example might be matching automobile registrations against tax return data to look for people of limited incomes who own expensive cars.

The American Bar Association identified several areas where this impinges on privacy rights, including the Fourth Amendment. New York and New Jersey shared welfare databases ad discovered 425 cases of people collecting welfare checks from both states using fake Ids.

The Internet and Privacy

Cookies

Most Internet usage is through the World Wide Web. Most web servers place small pieces of text on computers browsing their sites called "cookies." This was originally intended to make it easier to browse the web, but some companies use the cookie trails to find out information about users' websurfing habits.

While it is entirely possible to set your browser to refuse cookies, some sites will not provide web pages to computers that refuse cookies.

Communications Decency Act

Congress passed the Communications Decency Act in 1995, and it restricted written communication in an electronic medium, purportedly to protect children. It was ruled unconstitutional by the Supreme Court in 1997 as a restriction on free speech and an invasion of privacy. Congress passed the Child Online Protection Act in 1998, wchih makes it a crime to make any communication for commercial purposes that is "harmful to minors." Given the international nature of the Internet, is such legislation effective?

Carnivore

Carnivore is an FBI monitoring system that can monitor e-mail traffic so it can intercept information related to criminal suspects. Carnivore can scan millions of e-mail per second.

Spam

What we typically call "spam" is accurately called unsolicited commercial e-mail. Use of the term "spam" was adopted as a result of the Monty Python skit in which our SPAM meat product was featured. In this skit, a group of Vikings sang a chorus of "spam, spam, spam . . . " in an increasing crescendo, drowning out other conversation. Hence, the analogy applied because UCE was drowning out normal discourse on the Internet. [http://www.spam.com/ci/ci_in.htm]

The First Spam Message [http://www.templetons.com/brad/spamreact.html]

Mail-from: DEC-MARLBORO rcvd at 3-May-78 0955-PDT
            Date:  1 May 1978 1233-EDT
            From: THUERK at DEC-MARLBORO
            Subject: ADRIAN@SRI-KL
            To:   DDAY at SRI-KL, DAY at SRI-KL, DEBOER at UCLA-CCN,
            To:   WASHDC at SRI-KL, LOGICON at USC-ISI, SDAC at USC-ISI,
            To:   DELDO at USC-ISI, DELEOT at USC-ISI, DELFINO at USC-ISI,
               	
-- 117 lines deleted --
               cc:   BPM at SU-AI

               Note here how we get to the body of the message and there 
are still addresses going into it that wouldn't fit!

               MCKINLEY@USC-ISIB
               MMCM@SRI-KL
               OT-ITS@SRI-KA
             
-- 260 lines deleted--

               WYATT@HARV-10
               LEO@USC-ISIB
               YEH@LLL-COMP
               YONKE@USC-ISIB
               YOUNGBERG@SRI-KA
               ZEGERS@SRI-KL
               ZOLOTOW@SRI-KL
               ZOSEL@LLL-COMP
               DIGITAL WILL BE GIVING A PRODUCT PRESENTATION OF THE NEWEST 
MEMBERS OF THE DECSYSTEM-20 FAMILY; THE DECSYSTEM-2020, 2020T, 2060, AND 
2060T.  THE DECSYSTEM-20 FAMILY OF COMPUTERS HAS EVOLVED FROM THE TENEX 
OPERATING
SYSTEM AND THE DECSYSTEM-10  COMPUTER ARCHITECTURE.  BOTH THE 
DECSYSTEM-2060T AND 2020T OFFER FULL ARPANET SUPPORT UNDER THE TOPS-20 
OPERATING SYSTEM. THE DECSYSTEM-2060 IS AN UPWARD EXTENSION OF THE CURRENT 
DECSYSTEM 2040 AND 2050 FAMILY. THE DECSYSTEM-2020 IS A NEW LOW END MEMBER 
OF THE DECSYSTEM-20 FAMILY AND FULLY SOFTWARE COMPATIBLE WITH ALL OF THE 
OTHER DECSYSTEM-20 MODELS.

      WE INVITE YOU TO COME SEE THE 2020 AND HEAR ABOUT THE DECSYSTEM-20 
FAMILY AT THE TWO PRODUCT PRESENTATIONS WE WILL BE GIVING IN CALIFORNIA 
THIS MONTH.  THE LOCATIONS WILL BE:

    TUESDAY, MAY 9, 1978 - 2 PM
    HYATT HOUSE (NEAR THE L.A. AIRPORT)
    LOS ANGELES, CA

    THURSDAY, MAY 11, 1978 - 2 PM
    DUNFEY'S ROYAL COACH
    SAN MATEO, CA
 (4 MILES SOUTH OF S.F. AIRPORT AT BAYSHORE, RT 101 AND RT 92)

 A 2020 WILL BE THERE FOR YOU TO VIEW. ALSO TERMINALS ON-LINE TO OTHER
DECSYSTEM-20 SYSTEMS THROUGH THE ARPANET. IF YOU ARE UNABLE TO ATTEND,
PLEASE FEEL FREE TO CONTACT THE NEAREST DEC OFFICE
FOR MORE INFORMATION ABOUT THE EXCITING DECSYSTEM-20 FAMILY.

The Beginning of the Spam Epidemic [ http://www.templetons.com/brad/spamterm.html]

The term got really popular in April of 1994, when two lawyers from Phoenix named Canter and Siegel posted a message advertising their fairly useless services in an upcoming U.S. "green card" lottery. They had posted their message a few times before, but on April 12, they hired an mercenary programmer to write a simple script to post their ad to every single newsgroup (message board) on USENET, the world's largest online conferencing system. There were several thousand such newsgroups, and each one got the ad.

What Attracts Your E-mail Address To Spammers?

According to the Center for Democracy and Technology, most spam comes as a result of e-mail addresses appearing on public web sites and on USENET newsgroup postings. Spammers typically use programs that scan web pages for text with an @ embedded. This is a clear indication of an Internet e-mail address.

Spam and the Law

The sending of any unsolicited email advertising messages to this domain will result in the imposition of civil liability against you in accordance with California Bus. & Prof. Code Section 17538.45. [http://spam.abuse.net]

There is legislation currently in Congress that would make outlaw unsolicited commercial e-mail:

The House voted overwhelmingly Saturday [November 22, 2003] for a bill to outlaw most Internet spam and create a "do not spam" registry for those who do not wish to receive unsolicited junk e-mail. Online marketers who flood e-mail in-boxes with pornography offers and get-rich-quick schemes would face multimillion-dollar fines and jail time under the measure. [http://money.cnn.com/2003/11/24/technology/spam_law [downloaded November 24, 2003 at 12:12PM EST]

Patriot Act

The Patriot Act is a controversial piece of legislation passed shortly after the attacks on the World Trade Center and the Pentagon. While many people argue that it severely compromise basic American freedoms and others defend as a necessary weapon in the anti-terrorism arsenal that contains sufficient safeguards, few truly understand what the law contains:

The clumsily-titled Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act, or USAPA) introduced a plethora of legislative changes which significantly increased the surveillance and investigative powers of law enforcement agencies in the United States. The Act did not, however, provide for the system of checks and balances that traditionally safeguards civil liberties in the face of such legislation.

Legislative proposals in response to the terrorist attacks of September 11, 2001 were introduced less than a week after the attacks. President Bush signed the final bill, the USA PATRIOT Act, into law on October 26, 2001. Though the Act made significant amendments to over 15 important statutes, it was introduced with great haste and passed with little debate, and without a House, Senate, or conference report. As a result, it lacks background legislative history that often retrospectively provides necessary statutory interpretation. [http://www.epic.org/privacy/terrorism/usapatriot/#overview ]

The Patriot Act made it easier to obtain a court order for a wiretap because probable cause is no longer required:

Prior to the passage of the USA PATRIOT Act, the statute authorizing the use of "pen register" and "trap and trace" devices governed real time interception of "numbers dialed or otherwise transmitted on the telephone line to which such device is attached." Although the use of such devices requires a court order, it does not require a showing of probable cause. There is, in effect, no judicial discretion, as the court is required to authorize monitoring upon the mere certification by a government attorney that the "information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation." Therefore, such procedures lack almost all of the significant privacy protections found in Title III, the statute governing the interception of the actual "content" of a communication (e.g., a phone conversation or the text of an e-mail message).

Section 216 of the Act significantly expanded law enforcement authority to use trap and trace and pen register devices. Prior law relating to the use of such devices was written to apply to the telephone industry, therefore the language of the statute referred only to the collection of "numbers dialed" on a "telephone line" and the "originating number" of a telephone call. The new legislation redefined a pen register as "a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted." A trap and trace device is now "a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source or a wire or electronic communication." [ http://www.epic.org/privacy/terrorism/usapatriot/#overview]

Other provisions of the Patriot Act provide for:

Privacy Legislation

LegislationProvisions
Fair Credit Reporting Act of 1971 All credit agencies must make their records available to the person whose report it is; they must have established means for correcting faulty information; they are to make the information available to authorized inquirers only.
Crime Control Act of 1973 Any state information agency developed with federal funds must provide adequate security for the privacy of the information they store.
Family Education Right and Privacy Act of 1974 Educational institutions must grant students and/or their parents access to student records, provide means for correcting errors in the records and make such information available to authorized parties only.
Privacy Act of 1974 Restricts the collection, use and disclosure of personal information, and gives the individuals the right to see and correct such information.
Tax Reform Act of 1976 Restricts collection and use of certain information by the Internal Revenue Service.
Right to Financial Privacy Act of 1978 Restricts governmental access to certain records held by financial institutions.
Protection of Pupil Rights Act of 1978 Gives parents the right to examine educational materials being used in the schools, and prohibits intrusive psychological testing of students.
Privacy Protection Act of 1980 Government agents may not conduct unannounced searches of news offices or files, if no crime is suspected of anyone.
Electronic Funds Transfer Act of 1980 Customers must be notified of any third-party access to their accounts.
Debt Collection Act of 1982 Federal agents must observe due process before releasing bad debt data to credit bureaus.
Congressional Reports Elimination Act of 1983 Eliminated the requirement under the Privacy Act for all agencies to republish all of their systems notices every year.
Cable Communications Policy Act of 1984 A cable subscriber must be informed of any personal data collected (and when) and the use and availability there will be of such information.

Protecting Your Privacy

  1. Find out what is in your credit report. It can determine if you get a loan, an apartment, a job, or insurance coverage. It is available to credit grantors, employers, landlords and insurers -- anyone with a "legitimate business need." The crime of identity theft is rampant. Order your credit report at least once a year. Make sure it is accurate and check for fraud.
  2. To limit calls from telemarketers to your home phone or cell phone, sign up for the national “Do Not Call” registry. Call the toll-free phone number (888) 382-1222 or register online at www.donotcall.gov. Your phone number will stay on the registry for five years, or until you ask for your number to be removed from the list, or your phone number changes. You can renew every five years. Both inter- and intra-state telemarketers must update their lists each quarter with those who enroll in the registry.
  3. To get your name off mailing lists for pre-approved offers of credit, notify the credit bureaus at the following number: (888) 5OPTOUT (888-567-8688). Your one call is shared all three.
  4. To protect your financial privacy, tell you financial companies that they may not sell or share your customer data with other companies. Federal law requires banks, credit card companies, insurance companies, and brokerage firms to send you a privacy notice each year. Companies that sell customer data to unaffiliated third parties must enable you to "opt out."
  5. Look for ways to "opt out" of mailing lists to reduce "junk" mail. Many mail order firms, magazines and credit card companies now provide a box to check if you do not want your name, address, and shopping habits sold to or shared with other companies.
    In general, be aware that when you provide your name, address, phone number and other personal information, your name could end up on mailing lists. The following activities often result in "junk" mail and telemarketing calls:
    • Filling out warranty and product registration cards.
    • Joining or donating money to clubs, organizations, and charities.
    • Subscribing to magazines, book clubs and music/CD clubs.
    • Listing your phone number & address in the phone book.
  6. Avoid entering sweepstakes and other contests if you want to stay off mailing and telemarketing lists aimed at "opportunity seekers’ often called "sucker lists." The purpose of contests is to compile names and addresses that can be sold to marketers for other solicitations, such as fundraising or catalog offers. Some contests and special offers are scams, especially those that ask you for money up front or which offer get-rich-quick schemes.
  7. If you are an Internet user, do not send sensitive personal information (phone number, password, address, credit card number, SSN) by chat lines, e-mail, instant messages, forum postings, or in your online profile. Assume your messages are not private unless encrypted.
  8. Be very protective of your Social Security number (SSN). Only provide it when you know it is required (tax forms, employment records, most banking, stock and property transactions). If the SSN is requested by a government agency, look for the Privacy Act notice. This tells you if your SSN is required, what will be done with it, and what happens if you refuse to provide it.
  9. Find out if information about your medical history is stored in the insurance industry data base, the Medical Information Bureau (MIB). You may receive a copy ($9) of your MIB report by writing or calling: Medical Information Bureau, P.O. Box 105, Essex Station, Boston, MA 02112. (617) 426-3660. The report is free if you have received a letter from an insurance company stating they used MIB information to make a negative decision about you. As of April 2003, the federal privacy rule HIPAA gives individuals in all 50 states the right to access their medical records.
  10. Be aware of information gathering at the checkstand. California law and laws in some other states limit what can be requested when you pay by check and credit card. In California, merchants cannot write your credit card number on your check. When you pay by credit card, merchants cannot record personal information like address and phone number, unless the information is needed for situations like delivering the product to your home.
  11. Think twice before joining a "loyalty club" and using the club card when paying for groceries. When the card is scanned at the checkstand, your name and address can be linked to your purchases. If you do not want a profile compiled of your shopping habits, you can sign up under a generic name "grocery shopper") with no address. Or you can decide not to use club cards where they are offered. Better yet, vote with your dollars and shop at stores that do not use loyalty cards.
  12. Avoid calling 800, 888, 877, 866, and 900 numbers unless you already have a relationship with the company (like your favorite catalog company). When calling these numbers, your phone number can be recorded by a system called Automatic Number Identification (ANI) and then sold to marketers for mail and phone solicitations. (The Federal Communications Commission requires companies to get your consent before selling your phone number.)
  13. Be careful what you say on cordless and cellular telephones, especially older- models that are not digital. When you talk on a wireless phone, you are transmitting a radio signal. Even though it is illegal, your conversations can be picked up on radio scanners. Newer model digital phones are less vulnerable to eavesdropping. When you are in public places, do not reveal sensitive information like credit card numbers within earshot of others.
  14. For Caller ID, order Complete Blocking to automatically prevent your phone number from being transmitted on every call you make ("Per Line" Blocking in other states). If you have "Selective Blocking" ("Per Call" Blocking), remember to use *67 to block your number.
  15. If you are concerned about releasing your home address, rent a post office box or a commercial mailbox. For telephone privacy, get an unlisted number.
  16. Shield your hand when you use a bank ATM machine or make a long distance call at a public phone. Don't let others see your PIN numbers. Memorize your PIN numbers so you do not carry them in your wallet. Avoid using common PIN numbers like Social Security number, birthdate, and family members' names.
  17. For a copy of your driving record, visit the nearest office of the Department of Motor Vehicles. Bring your driver's license or state ID card. The fee varies. In general, you have a right to most government records about you. Some of your personal information held by government agencies may be public record and accessible to anyone.
  18. Read the fine print on applications and order forms. You may be given additional privacy protection or have it taken away in almost unreadable text.
  19. [http://www.privacyrights.org/fs/fs1-surv.htm]

    [Back to the Notes Index]