I read The Day the Music Dies in the SF Weekly yesterday. I had heard about this issue but didn’t realize it was so pressing. I am a huge Pandora Listener – I love it because I don’t remember music names and stuff…I don’t have a “music brain” but I like music…so I put in a song I like and it plays more like it.
I encourage you if you are in America and have a congress person call them. (I can’t vote so I feel weird engaging in the political process until I can.)
ID Topics
Frontline: Spying on the home front
I am a fan of public television. I grew up with the CBC and its wonderful documentaries and comedies (Kids in the Hall anyone). Since moving to the US I have found Frontline and since I don’t have a television I am blessed to be able to watch it online.
They recently had a great show called Spying on the Home Front that was well done and quite disturbing. Basically we are all being spied on all the time because we are all suspects in the doctrine of pre-emption. The disturbing thing about it all is the use of National Security letters that can not be discussed. This double silencing is particularly disturbing. I picked up a book called the Elephant in the Room:Silence and Denial in Everyday Life – it highlighted this phenomena.
Yet what makes conspiracies of silence even more insidious than covering it up is the fact that the silence itself is never actually discussed among conspirators. Unlike when we explicitly agree not to talk about something (“let’s not get into that”), the very fact that the conspirators avoid it remains unacknowledged and the subtle social dynamic underlying their silence are thus consealed….
the reason it is so difficult to talk about the elephant in the room is that “not only does no one want to listen, but no one wants to talk about not listening.” In other words the very act of avoiding the elephant is itself the elephant! Not only do we avoid it, we do wo without acknowledging that we are actually doing so, thereby denying our denial.
Like “rules against seeing rules against seeing,” being “forbidden to talk about the fact about the fact that we are forbidden to talk” about certain things, or the fact that “we do not see what we prefer not to, and do not see what we do not see,” such meta-denial presupposes a particular form of self-deception famously identified by Orwell as “doublethinking,” or the ability “consciously to induce unconsciousness and then to become unconscious of the act of Hypnosis you had just performed.” Thus in Nineteen Eighty-Four, when Eastasia suddenly assumes Eurasia’s traditional role as Oceania’s perpetual enemy and the Oceanians set out to immediately destroy or rectify any references ever made to their long-lasting war with Eurasia, Orwell astutely observes that “the work was overwhelming, all the more so because the process that it involved could not be called by their true names.”
I would recommend the the Frontline show and would love to discuss it with others who have seen it. Perhaps this can be another one for our Media Review Group. I hope there will be a critical mass of folks to actually talk about this next week at Burton Group.
9/11 has indelibly altered America in ways that people are now starting to earnestly question: not only perpetual orange alerts, barricades and body frisks at the airport, but greater government scrutiny of people’s records and electronic surveillance of their communications. The watershed, officials tell FRONTLINE, was the government’s shift after 9/11 to a strategy of pre-emption at home — not just prosecuting terrorists for breaking the law, but trying to find and stop them before they strike.
President Bush described his anti-terrorist measures as narrow and targeted, but a FRONTLINE investigation has found that the National Security Agency (NSA) has engaged in wiretapping and sifting Internet communications of millions of Americans; the FBI conducted a data sweep on 250,000 Las Vegas vacationers, and along with more than 50 other agencies, they are mining commercial-sector data banks to an unprecedented degree.
Even government officials with experience since 9/11 are nagged by anxiety about the jeopardy that a war without end against unseen terrorists poses to our way of life, our personal freedoms. “I always said, when I was in my position running counterterrorism operations for the FBI, ‘How much security do you want, and how many rights do you want to give up?'” Larry Mefford, former assistant FBI director, tells Smith. “I can give you more security, but I’ve got to take away some rights. … Personally, I want to live in a country where you have a common-sense, fair balance, because I’m worried about people that are untrained, unsupervised, doing things with good intentions but, at the end of the day, harm our liberties.”
Although the president told the nation that his NSA eavesdropping program was limited to known Al Qaeda agents or supporters abroad making calls into the U.S., comments of other administration officials and intelligence veterans indicate that the NSA cast its net far more widely. AT&T technician Mark Klein inadvertently discovered that the whole flow of Internet traffic in several AT&T operations centers was being regularly diverted to the NSA, a charge indirectly substantiated by John Yoo, the Justice Department lawyer who wrote the official legal memos legitimizing the president’s warrantless wiretapping program. Yoo told FRONTLINE: “The government needs to have access to international communications so that it can try to find communications that are coming into the country where Al Qaeda’s trying to send messages to cell members in the country. In order to do that, it does have to have access to communication networks.”
Spying on the Home Front also looks at a massive FBI data sweep in December 2003. On a tip that Al Qaeda “might have an interest in Las Vegas” around New Year’s 2004, the FBI demanded records from all hotels, airlines, rental car agencies, casinos and other businesses on every person who visited Las Vegas in the run-up to the holiday. Stephen Sprouse and Kristin Douglas of Kansas City, Mo., object to being caught in the FBI dragnet in Las Vegas just because they happened to get married there at the wrong moment. Says Douglas, “I’m sure that the government does a lot of things that I don’t know about, and I’ve always been OK with that — until I found out that I was included.”
A check of all 250,000 Las Vegas visitors against terrorist watch lists turned up no known terrorist suspects or associates of suspects. The FBI told FRONTLINE that the records had been kept for more than two years, but have now all been destroyed.
In the broad reach of NSA eavesdropping, the massive FBI data sweep in Las Vegas, access to records gathered by private database companies that allows government agencies to avoid the limitations provided by the Privacy Act, and nearly 200 other government data-mining programs identified by the Government Accounting Office, experienced national security officials and government attorneys see a troubling and potentially dangerous collision between the strategy of pre-emption and the Fourth Amendment’s protections against unreasonable search and seizure.
Peter Swire, a law professor and former White House privacy adviser to President Clinton, tells FRONTLINE that since 9/11 the government has been moving away from the traditional legal standard of investigations based on individual suspicion to generalized suspicion. The new standard, Swire says, is: “Check everybody. Everybody is a suspect.”
German Data Retention, NSA doesn't Trust itself & FBI and "spying student" profiles
From Slashdot:
“Google is threatening to shut down the German version of its Gmail service if the German Bundestag passes it’s new Internet surveillance law. Peter Fleischer, Google’s German privacy representative says the new law would be a severe blow against privacy and would go against Google’s practice of also offering anonymous e-mail accounts. If the law is passed then starting 2008, any connection data concerning the internet, phone calls (With position data when cell phones are used), SMS etc. of any German citizen will be saved for 6 months, anonymizing services like Tor will be made illegal.”
Well if the can’t collaborate maybe they can’t spy on us all that well?
Linked to the Baltimore Sun from Slashdot:
NSA employees also do not trust one another, which has left the agency fragmented and in search of a “unity of purpose,” according to a task force report released to employees late last month.”What we need is fundamental change in the way we manage NSA and what we expect of management and ourselves,” concluded the study, which was led by George “Dennis” Bartko, the NSA’s deputy chief of cryptanalysis. The Sun obtained unclassified portions of the report and eight related documents.
US university students will not be able to work late at the campus, travel abroad, show interest in their colleagues’ work, have friends outside the United States, engage in independent research, or make extra money without the prior consent of the authorities, according to a set of guidelines given to administrators by the FBI.
“FBI is offering to brief faculty, students and staff on what it calls ‘espionage indicators’ aimed at identifying foreign agents. Unexplained affluence, failing to report overseas travel, showing unusual interest in information outside the job scope, keeping unusual work hours, unreported contacts with foreign nationals, unreported contact with foreign government, military, or intelligence officials, attempting to gain new accesses without the need to know, and unexplained absences are all considered potential espionage indicators.”
Yeah! for the Fourth Amendment
I have been worried about this for a while (see this post from Dec 2006 and way back when in August 2005 when I first was alerted to this issue) Just when things were looking really grim on the online privacy front this ruling came in…..from Wired Blogs:
The ruling by the Sixth U.S. Circuit Court of Appeals in Ohio upheld a lower court ruling that placed a temporary injunction on e-mail searches in a fraud investigation against Steven Warshak, who runs a supplements company best known for a male enhancement product called Enzyte. Warshak hawks Enzyte using “Smiling Bob” ads that have gained some notoriety.
The case boiled down to a Fourth Amendment argument, in which Warshak contended that the government overstepped its constitutional reach when it demanded e-mail records from his internet service providers. Under the 1986 federal Stored Communications Act (SCA), the government has regularly obtained e-mail from third parties without getting warrants and without letting targets of an investigation know (ergo, no opportunity to contest).
It is sort of odd that it is about penis spam but hey – freedom is freedom is freedom.
To reach its decision, the court relied on two amici curiae that presented compelling arguments for shoring up current privacy law with respect to e-mail. The article is worth reading in full.
Age and Idetntity in Second life
I just found this from someone linking to my WoW piece. It seems that Linden Lab will be doing age verification – from their blog:
We will shortly begin beta testing an age and identity verification system, which will allow Residents to provide a one-time proof of identity (such as a driver’s license, passport or ID card) and have that identity verified in a matter of moments.
Second Life has always been restricted to those over 18. All Residents personally assert their age on registration. When we receive reports of underage Residents in Second Life, we close their account until they provide us with proof of age. This system works well, but as the community grows and the attractions of Second Life become more widely known, we’ve decided to add an additional layer of protection.
Once the age verification system is in place, only those Residents with verified age will be able to access adult content in Mature areas. Any Resident wishing to access adult content will have to prove they are over 18 in real life….
Landowners are morally and legally responsible for the content displayed and the behavior taking place on their land. The identity verification system gives them new tools to ensure any adult content is only available to adults over 18 because unverified avatars will not have access to land flagged as containing adult content…..
The verification system will be run by a third party specializing in age and identity authentication. No personally identifying information will be stored by them or by Linden Lab, including date of birth, unless the Resident chooses to do so. Those who wish to be verified, but remain anonymous, are free to do so.
There is an extensive FAQ in the blog post. It seems that online life is going to get more complex. I wonder what vendor they are going to use for this. I wonder how it will work internationally.
The other thing I wonder about is how necessary is this. I kids are exposed to so much already. I am currently reading GenerationMe: Why Today’s Young American’s are more Confident, Assertive, Entitled – and More Miserable Than Ever Before by Jean M. Twenge. Some of the book talks about the current attitudes about sex and the sexual practices of young people. The Monica Lewinsky was all happening when they were in elementary school. They know what sex is and many many of them are doing it – lots are having oral sex (mostly the girls giving it to the guys) in middle school and by highschool many are sleeping around with a lot of partners ‘hooking up’ without really being in boyfriend girlfriend relationships. Yes they are doing it with their peers and not other adults but it is not like it is news to them. I am not condoning this trend of hyper sexually active young people. The number and range of these surveys means it is real not imaginary. I also don’t think they should have access to adult areas of Second Life. The issue is serious and I think there is a social dialogue about sex, its meaning would be a good thing to foster. It is a disconcerting to learn how casual it is being taken by youth however as the author points out imitating the way it is portrayed in the media. So what is the big deal with Avatars in a virtual world I wonder. I hope this question is not to much to ask and that I will not be harshly judged for having asked if we should ask this question.
Personally I gave up on SL 9 months ago for other reasons. I was fed up with downloading a new massive client to wander around an aimless 3D space. Then to top it all off the were hacked and you had to call them to get a new password. I also was annoyed the first thing you had to do was pick your name with some strange last name from a list they determined. Once you picked your name you couldn’t change it….it was the one thing persistent about you. I think online 3D has potential but I am convinced there will be worlds that leapfrog SL.
Here are some of the comments about the proposal on their site
I do not wish to have my personal information – my SSN or anything else, in the hands of a 3rd party organization – or even in the hands of SL. I am very cautious about what info I put out there – and considering how easily sites can be hacked, this is a security issue. Some of us have RL clearances and do not want more info out there – and as such – we will now be unable to access adult content? Let’s face it that’s why many of us put up a credit card for premium membership – to prove our age. Further proof is a burden on the players that we should not have to bear.
First, you should be aware it is illegal to require an individual to provide his/her social security number as a means of identification to anyone but the Federal Government. Second, if driver’s license and or SSN is provided to you or your agent you may become legally liable for the misuse, loss, or theft of that information for the purposes of fraud or identity theft. Good Luck.
A third party that LL trusts and isn’t giving us who this third party is, I’m taking issue with. The moment I give them my driver’s license, they will now own my name, address, license number, AND because I live in a state that puts the Social Security number on the driver’s license, they will have that as well. I’m not impressed with this action nor do I trust LL’s belief in this third party that they will not keep this data. Prove it!
“Driver’s license, passport or ID card” are you joking?
I think you need to come to grips with a few things. Half the residents in SL do not live in Puritanical America. Your ‘immature’ attitude toward sex and alcohol are not shared by the majority of people on Earth. There is no drinking age in most of Europe and Asia and most people look upon sex as a normal human activity.
What about those of us without passports, drivers’ licences or any form of national ID? You falsely assume that all adults have one of these things – not all of us drive, go abroad or live in countries with Big Brother-style ID card schemes.
The best bit IMO is we’re now expected to pay for the privilege of being treated like adults. Are we not mature enough to be given the responsibility of ignoring things we don’t want to see? The way I see it this system is good in theory but completely flawed in practice.
Once again, Linden Labs adopts a US-sentric attitude. US players only have to provide the last 4 digits of their Social Security numbers, while non-US residents have to provide a full National ID Number (whatever that is, and whatever countires use them) or a full passport number! What about people who have no National ID, or passport? What are they to do?
This sounds very heavy handed. It sounds like a roomful of lawyers, FBI Agents, and other law enforcement put the fear of Gawd in to Linden to have them take the extreme step of seeking partial social security numbers, and age verification via key documents. I believe the point has been raised the credit card verification is typically enough to meet age requirement guidelines.
As a UK resident, I do not feel comfortable about giving personal details to an as yet unamed data collection company, which I assume is US based.
With the current climate in the US as regards to Bush’s evesdropping on data communications to aid the War on Terror(tm), I do not want to end up on some US government database as belonging to a virtual porn-ridden community run by a bunch of subversive godless burnt-out californian commie hippies (Ann Coulter is hawt!!).
Supernova Open Space June 19th – come talk about Identity
I am working with Supernova to facilitate their Open Space day on June 19th at Warton West this is going to be great. It is basically free with a price of $25 (this is so that people who say they are coming actually do).
The Supernova Open Space Workshop is an open forum on the social, moral, technical, and strategic questions impacting the increasingly connected world in which we live. Discussions about topics like user control, neutrality, identity and open standards are setting the stage for future policies and economic decisions. Come to this event to learn more, participate in the community and shape the future of the New Network.
Doc is going to be actively involved and hosting active conversations around Vendor Relationship Management. I hope we can also dive into other aspects of identity and the next web.
Sex offender mixup on MySpace and AmeriTrade Spam
Last week there were some interesting identity developments.
summary: Ms. Jessica Davis had her Myspace profile eliminated because it matched a name in a sex offender database. She tried to resolve it with Myspace but they were very unhelpful. She went to the press after learning about a new information sharing agreement between MySpace and states attorney generals. She is planning to go into law and public service and did not want to be in a position for the rest of her life defending her innocence because they put her in some database.
AmeriTrade Spam: “On April 14, 2007, I signed up for an AmeriTrade account using an e-mail address consisting of 16 random alphanumeric characters, which I never gave to anyone else. On May 15, I started receiving pump-and-dump stock spams sent to that e-mail address. I was hardly the first person to discover that this happens. Almost all of the top hits in a Google search for “ameritrade spam” are from people with the same story: they used a unique address for each service that they sign up with, so they could tell if any company ever leaked their address to a spammer, and the address they gave to AmeriTrade started getting stock spam. “
Tinfoil Hat for WoW … When is it coming to First Life?
Identity issues in Virtual worlds are interesting. World of Warcraft an online Massive Multiplayer Online Game MMOG recently launched “The Armory”
a vast searchable database of information for World of Warcraft – taken straight from the real servers, updated in real time, and presented in a user-friendly interface. Since the Armory pulls its data from the actual game servers, it is the most comprehensive and up-to-date database on the characters, arena teams, and guilds of World of Warcraft in existence.
This needles to say freaked some folks out enough that Blizzard has chosen to address “player aversion to the Armory…by adding a new item, the Tinfoil Hat.”
The Burning Crusade added an abundance of new profession recipes and player-created items to World of Warcraft. One of these brand-new items is the Tinfoil Hat. While the Tinfoil Hat provides the wearer with added protection against mind control and other befuddlements, the hat’s most interesting and truly unique property is that it completely removes the wearer’s character profile from the Armory website and provides enhanced privacy for its wearer!
Now if we could only do that with our digital records.
http://games.slashdot.org/article.pl?sid=07/04/01/1414240
Genetic Non-Descrimination bill in house
From Slashdot….on New Scientist.
Soon it will be illegal to deny US citizens jobs or insurance simply because they have an inherited illness, or a genetic predisposition to a particular disease.
On 25 April, the House of Representatives voted 420 to 3 to pass the Genetic Information Nondiscrimination Act (GINA). The Senate is expected to endorse the act within a few weeks, which is also supported by President Bush. “I am so stunned by the majority,” says Sharon Terry, president of the Genetic Alliance, a charity lobbying for the rights of people with inherited illnesses.
“Clearly the House finally understood the incredible significance this has. The American public can now access genetic tests, feel safe about their genetic information not being misused and participate in research that involves genetic information.”
This is all good news. I also got me wondering about a form of discrimination that I think about regularly and face it is what I call “where I happened to emerge out of my mothers womb.” This fact my place of birth has incredibly little do with who I am the content of my character who I am where I fit in my social context how much I contribute to the society I live in but is regularly requested by institutions.
Comment from Scott Cadzow on "What is Identity?"
Scott Cadzow was at the first ITU meeting. Like me he is an independent consultant who spent a lot of time in standards land particularly with mobile efforts in Europe. He read my “What is Identity?” post and had this comment (sorry commenting doesn’t really work on my blog I have to get this fixed anybody know a good wordpress wiz?)
I wonder if identity as a social construct and identity as a transferable element are not getting confused? Who I am is too complex to summarise in a few sentences, maybe not even in an autobiography stretching across many volumes. In part this is because my perception of my identity is not what others perceive of my identity and as such any declaration of who I am is always false as the entity I declare it to will have a different end view. However if I give you my email address that allows access to the more complex part of identity. If a thief can gather sufficient pointers to your identity they may be able to masquerade as you, but whilst I could give all of my details to somebody they would fail to masquerade as me to someone who knows me in person (family or employer say).
In the ITU-T world identity has to be decomposed to what is available in their world and simply they cannot hope to maintain knowledge related to the societal you, only the knowledge that allows them to make connections to a possible you (telephone numbers address the telephone and not the person and quite simply I am not a telephone). However it is sufficient in the ITU-T space to say that the form of identity they deal with is sufficient to describe the thing that communicates (people use phones to make connections, the ITU-T makes sure that phones can make connections and they do not offer to make connections for people).
In my field of security, and securing identity as a task with it, there is no way that I can offer to protect your identity in all its societal richness. However I can make sure that you will be able to make decisions on the value of some parts of identity (the identifier) by allowing to verify its authenticity and its authority (if it is an authoritative identity). We certainly don’t need to go back to birth certificates for this proof (apart from anything else these can be forged).
Whilst I will agree that identity needs protection it also needs basic common sense (the power of real names in legend should be updated for the modern age – don’t release more data than essential and get systems to default to minimum release policies).
My point is that it is dangerous to conflate identity with identifiers and then say to the public you are your identifier and that the STATE has all the power to ‘validate’ who you are with those identifiers. This is a police state in the making and billions of people world wide have no ‘valid’ stat papers. It doesn’t mean they should not get on the network.
True and I hope nobody is trying to say identifier is identity in all contexts. What I want to note is that if the context is a phone call the only identity from the protocol view is the phone number, from the person using the phone the phone number does not equate to identity (different context, different identity). Rehash: Identity is relevant in context and not all contexts are the same so the value of identity is as varied as the contexts it is placed in.
Your suggestion that the state validates identifiers is harsh. The authority for an identifier is responsible for the validation and the authority need not be the state (most often isn’t). This is the reason behind my view of identity being authoritative or non-authoritative. In the real world we can only verify some identifiers as authoritative and not identity in the societal case (as we cannot have authoritative context although for forensic examination and recovery reasons we may wish to).
In Wired about CFP
I just checked my visitors log and found a link from WIRED that mentions me.
While many websites do not collect names, addresses, Social Security numbers or other “personally identifiable information,” or PII, the information they do collect is extremely revealing. “They don’t need to know your name to know who you are,” Chester said.
A very different perspective came from Mike Zaneis of the Internet Advertising Bureau. Dressed in a much better suit than any other CFP participant, and sporting a John Edwards-quality quaff and a smooth manner, Zaneis faced a hostile, privacy-loving crowd.
Zaneis stressed that profiling does not capture PII. But the audience appeared to agree with Chester that browsing history and search information was nonetheless private. “My clickstream data is sensitive information,” said privacy activist Kaliya Hamlin, known as the Identity Woman, “and it belongs to me.”
I am not sure that I would describe myself as a privacy activist but rather an end-user advocate passionate about open standards.
I found the panel described in the article frustrating. It was one angry progressive anti-consumer guy vs. the super corporate marketing guy. The ‘activist types’ tend to deny that we are people who actually might want to buy things in a market place. The ‘corporate types’ tend to think that we always want to have ‘advertising’ presented to us at all times of day or night because we ‘want it.’ Neither view is really right. I pointed out that there was an option to give users back their ‘attention’ (clickstream) data from the sites that they visit. There could be ways to actually express one’s market needs/preferences and get advertising related to that specific need (this is not enabled anywhere that I know of right now). The VRM (Vendor Relationship Management) discussion is getting interesting and hopefully we can talk more about the issues raised in the space in between privacy and advertising at IIW next week.
Transgender issues with Privacy and Identity at CFP
Mara Keisling the Executive Director of the National Center for Transgender Equity presented about the privacy and identity issues faced by Transgender people.
Identification Documentation
What is important for that about transpeople? – It is mportant what it says and also what it refers to. For example my passport says – ‘this passport says that this was changed for male to female’
Why does this matter because the revelation of one’s transgenderness is a risk – that we know of in the US one transgender person per month is murdered. Violence is a issue.
There are economic consequences to be outed at work or as part of a job interview and fired or not given job in the first place. In San Francisco – over 50% were unemployed or had fragile employment.
The REAL ID ACT is a problem.
It has not been implemented yet but what is very obvious consistent ID documentation is hard to get – for low income people, transgender, homeless people, immigrants. It will make it increasingly difficult.
The data is interconnected across ALL law enforcement.
It mandates certain things be on the front it.
Gender is required.
The fact of name change required – obvious that they changed name from say Mark to Mara.
Will Fact of gender change will be required? It likely will be in database. Along with surgical records – will end up in database. This means it outs transgender people every time interact with law enforcement.
It also means any time one’s ID is checked electronically to get into a bar for a drink it will out people. This is not a big deal in a big city is it s BIG deal in small towns.
Travel
It is difficult. I have friends who say “‘you travel’ – you are willing to fly?”
The TSA currently has no policy specific to transgender people and their frisking at airports.
They do have policy regarding how they are to interact with ‘helper monkeys’ (seeing eye dogs etc.) TSO’s are not aloud to touch your helper monkey’s.
At the very least they would like guidelines for searching.
It is difficult to get a passport. They almost always require you to present proof of gender change with the presentation of surgical records. However almost none have genital surgery – they estimate only 5% the reason is that there are many contra indications (HIV status, age, pulminary issues) and it is very expensive.
There is no security interest in labeling as me as a male. They are going to have a hard time finding me…(she presents as female).
It is a privacy violation to have ‘surgery letter.’
Scatterback x-ray machines “strip” naked and covers gender. This security measure is creepy for everyone – creepy and dangerous for transgender people.
Employment Verification
Mapping all these databases – to monitor so the SSN administration sends ‘no match’ letters – new employee…is this person eligable to work. This is supposed to just be for name or social security number. However there s an Optional data-field in this database and they can end up with ‘non-match’ letters because of gender basically – “you think lily is a woman – we think Lily is man”
An example she gave was heart breaking. A man was working at as a Steelworker for 20 years. The company he worked for ran all its people through the process you do with SSN administration and his supervisor came out in front of the crew that he worked with on a daily basis and said “Social Security says your a woman.”
He quit his job and wondered if he was going to have to find a new job every quarter because of this.
Employers with a large number of employees can do this via computer but small employers who do this via the phone – the operators are taught to ask for gender to enhance the match.
Health Privacy
Transgender people are turned away from hospitals all the time
A passing (not out) trasngender nursing student in florida as part of their training they were given specific information about what to do for man and women in certain situations. She asked
“What do you do with transgender people? are there any special considerations?” The trainer said “When I was in ER in New York we just let those people die.” You can be murdered because of your transgenderness in the health system.
Prescription records – many transgender people have histories that out them. Old data remnants matched with my old self with my new self (estrogen taking).
RFID
Freaked out about this passports because of information that will be shared. I don’t want this to flash on every screen when cross boarders.
Clothing that is worn or bought what if was from a credit card that I got got when male.
Data Permanence
Examples given.
Said in front of city council – I am a man with no penis. It was written up by the Philadelphia Inquirer – now when you google this person this is the first hit. it will be there forever.
Susan Stantant – Fired as city manager in Florida. Someone commented in the paper that now shows up in google “because she is taking estrogen no longer get erections”.
A woman was fired because court transcripts of parents custody battle from when she 10 years old. Someone else had fraudulently used her SSN and there for she was a ‘high security risk’ and denied her job.
Privacy Commissioner of Canada opens CFP
Computers Freedom and Privacy opened with the Privacy Commissioner of Canada Jennifer Stoddart. It was a great talk and here is what I captured from it –
We are endanger of loosing our rights.
She gave an introduction to the state of privacy in Canada. There has been a Privacy Act since 1983 that gives the privacy commissioner authority under the act.
- Fixed Term for independence from the government of the day.
- Reports directly to parliament.
- Advocacy through parliament.
- People who have been denied privacy in some way can complain
- Oversight of 150 federal government agencies including – RCMP (National Police), CSIS (Canadian CIA), Communications Security Establishment (surveys foreign communication)
She highlighted the case of Maher Aror an innocent Canadian citizen deported to Syria from the US and part of the reason for this was that the Canaidan government provided misleading information.
Canada more recently passed the Personal Information Protection and Electronic Documents Act – PIPEDA which was Introduced in response to the EU Data Protection Directive requirements.
Canada one of few countries out side of the EU that has ‘adequate’ privacy protections and is a place were EU data can be exported here.
Privacy Commissioner of Canada responsible for the application PIPEDA and has the power to:
- Investigate complaints
- Go to Court
- Conduct audits
- Produce reports
- Liaise with industry, consumer groups and parliament.
This is a good law because there is:
- No requirement to register databases (as in Europe).
- No yearly fees to remit.
- No reports to files to data commissioner.
- No authorization to export data.
There is no named constitutional right of privacy however the canadian courts have interpreted Canadian charter of rights and freedoms to provide this.
There is a tangle and it is a challenge to address privacy.
Country only legislation is not enough International cooperation is needed. She is involved in the OECD where she is the chair volunteer group on transboarder privacy enforcement.
Canada’s response to Anti-Terro Legislation-
Trying to find the right balance between privacy and security
Anti-terrorism Act of 2001 has impacted privacy rights through:
- Broadened surveilance powers
- Weekened constraints on use of powers
- Reduced accountability and transparancy of governmnet
Lack of facts and evidence to suggest that the measures in the Act are necessary
Parliament has not acted on the expressed concerns.
She highlighted the UK information Commissioner talking about Working Together
- Too many different privacy controls in different parts of the world.
- Inconsistency cause complexity, increased costs, and reduced consumer trust and confidence.
- Consistency reduces the trans-boarder data flow and protects information.
- The US and EU should work together.
Substantive agreement on privacy recognized rather then details about how it happens.
We need to question government policies that encroach on freedoms
Is surveillance a long term solution?
We must look at how these threats to us come about. Are we just perpetuating anamosity that leads to people wanting to cause harm to us?
How do these threats to our security come about and what are alternatives do we have to massive surveillance.?
We must explore new contours for privacy.
Oh yes…she also pointed out the US had prohibited entry of a Canadian researcher who had in the 60’s taken LSD as part of experiments at Stanford that he found out when he ‘googled’ the guy when he was crossing the boarder and reading the article that came up describing this. It was covered in TheTyee just last week.
SHE DIDN’T talk about the Canadian Government doing the same thing to US Citizens with minor criminal records. Covered in the San Francisco Chronicle in February. She is coming back and we can ask her questions hopefully she will also turn the spotlight on her own countries behavior with regard to this. It is all happening because of the sharing of criminal records cross boarder.
Take the case of 55-year-old Lake Tahoe resident Greg Felsch. Stopped at the border in Vancouver this month at the start of a planned five-day ski trip, he was sent back to the United States because of a DUI conviction seven years ago. Not that he had any idea what was going on when he was told at customs: “Your next stop is immigration.”
Felsch was ushered into a room. “There must have been 75 people in line,” he says. “We were there for three hours. One woman was in tears. A guy was sent back for having a medical marijuana card. I felt like a felon with an ankle bracelet.”
Or ask the well-to-do East Bay couple who flew to British Columbia this month for an eight-day ski vacation at the famed Whistler Chateau, where rooms run to $500 a night. They’d made the trip many times, but were surprised at the border to be told that the husband would have to report to “secondary” immigration.
There, in a room he estimates was filled with 60 other concerned travelers, he was told he was “a person who was inadmissible to Canada.” The problem? A conviction for marijuana possession.
In 1975.
Welcome to the new world of border security. Unsuspecting Americans are turning up at the Canadian border expecting clear sailing, only to find that their past — sometimes their distant past — is suddenly an issue.
Identity Panel at Mix07
We had a great panel at Mix07 Microsoft’s Developers Conference. It was moderated by Marc Canter, with Kim Cameron, Scott Kveton and myself.
We opened with a context setting presentation (up on slideshare) that I put together to help get us started.
Marc hammered the point home that Single-Sign-On was not ‘enough’ we all agreed.
We talked about security issues and how CardSpace was one option to address the challenge of phishing.
We talked about how Authentication (SSO) was different then data sharing and how we need to figure out how people connect data between different sessions.
I said we needed “myAPI” so that we could let people conntect their data and not give away their username and password to connect stuff up (like they have to do today).
Marc said that the IIW was just a talk fest that he would not go to. I pointed out that the IOS in Brussels last week OpenID and ID-WSF
Marc criticized Facebook for the terms that they release face-book data under saying it could not be shown to anyone except Facebook members. The Facebook guy stood up and said that he was misinterpreting the meaning of it – what it really said was that if a user had certain people who could see different things those preferences needed to be respected.
Marc got down on his knees and apologized while singing the end of an aria – it was very entertaining.
We also got to hear about Sharks and Toasters. Many people are afraid of sharks but more people die every year because from using a toaster but no one is afraid of toasters.
Over all it was a great session. Thanks to all who participated.
How do you validate who you are?
This story was just posted on Slashdot and raises interesting questions about how we determine how we determine who someone is in relationship to digital content.
“A fifteen year old from Perth, Australia, posed as an employee of the Australian Broadcasting Commission, demanding that YouTube remove hundreds of video clips of ‘The Chasers War on Everything.’ The amusing part is that The Chaser is a comedy company well known to perpetrate exactly this sort of prank.”
Museums and the Web presentation
I was asked by Jennifer Trant to come speak on the closing plenary for Museums and the Web. Here is the talk I am giving.
I didn’t go to a whole lot of the conference but what I did see on Thursday covered three talks on Tagging and the issues that managing digital content in relationship to museum collections raises.
Tagging and Searching – serendipity and museum collection databases by Sebastian Chan, Australia.
When is a terracotta hut urn like a sailor’s deck-log?: Meaning instantiated across virtual boundaries. Richard Smiraglia, USA
Personalized Museum Experience: The Rijksmuseum Use Case
Lora Aroyo, Rogier Brussee, Peter Gorgels, Lloyd Rutledge, Natalia Stash, Yiwen Wang, The Netherlands.
Mike Jones is Self-Issued
Mike Jones has started blogging on Self-Issued. This is an exciting development to have him join the “identosphere”
Designing Experience is relevant to Identity
Stop Designing Products was the name of the presentation by Peter Merholz from Adaptive Path.
I think the content of this talk is really important for us identity folks to think about. This past week I have been thinking about my own reason for being in identity as a field – because I wanted to support people being able to do things they couldn’t do without an identity layer. The core building blocks of the technology are finally here and their diffusion is beginning. So, this has got me thinking about what I would like to see built and how I want to contribute to projects building these things.
Yes after three years in this industry and starting out with a product project needed identity (but it didn’t exist). I do have some visions for products or perhaps more accurately visions of user experience that use identity that would be fun to manifest now that tools exist.
So back to the presentation at hand – Designing Experience.
It began with a sharing of some product development history – of the Kodak Camera and how they had a guiding star – You take the picture we will do the rest.
Triangle
POINT: Experience (cut to the point)
MIDDLE: Features (pile them on)
BASE: Technology (something you couldn’t do before)
Lesson: Start from the Experience
TiVo is an example.
Products are People Too
They Know Who they Are
(They are not trying to be something they are not)
As Designers and Programmers we think like this about products
data (Center)
logic (outside center)
user-interface (outer ring)
Data outward ->
But
They see the user-interface (Magic)
Outside In ->
He referenced Designing from the outside on O’Reilly Radar.
Experience Strategy
(collective shared by many people across many platforms)
You press the button and we do the rest. (Kodak)
Google Calendar – they had a vision…
Carl Sjogreen, Product manager)
Now they are nipping on the heals of Yahoo! Calendar.
Leapfrog potential when Experience Design.
Have a Star to sail ship by.
About Flickr has some good ones that are a filter for all decisions
Deliver on cohesive experience strategy.
THE EXPERIENCE IS THE PRODUCT.
The Nature of the Web
This is a great documentary about Net Neutrality by the folks who did Four Eyed Monsters. It gives a great overview of the history of other communications technologies and how they were enclosed after their initial burst of freedom and expression. I have a deep affection for the web and its power to empower people am also very concerned about the future of it as a communications commons.
I learned a lot about the network-centric point of view at the ITU-T IdM Focus Group meeting. I have a much deeper respect for the complexity of the issues that affect ‘the network’ and ‘the internet.’ I am committed to an ongoing engagement to build shared meaning, understanding and figure things out. I am speaking next week at Emerging Telephony and I believe that ‘identity’ is a key to giving Telco’s a way to support the web’s network.
I will be blogging more about the past few weeks in the next few days.
International Telecommunications Union Focus Group on Identity Management
Just after the holidays I heard about this Identity Focus Group meeting that the ITU was convening. It was suggested by David Recordon and Michael Graves that I go. I made a few more inquiries and by the end of the week I was talking to Abbie Barbir, Richard Brackney and Tony Rutkowski about going.
The have some ambitious deliverable goals:
- A living list of standards bodies, forums, and consortia dealing with Identity Management, including information concerning their activities and documents in the context of IdM framework.
- A global analysis of IDM requirements and capabilities.
- A study of various mechanisms for discovering different identification schemas.
- Developing an IdM framework including data models/schemas
- Producing a set of IdM telecommunications/ITC use cases that can be used to derive requirements.
I asked them what the format would be and they said the were thinking about doing ‘working group’ meetings for three days. I put forward the idea that they might consider open space since it was working so well at the Internet Identity Workshop for all the different technical communities and social issues participating. They agreed!
The first day will be chalked full of 1/2 hour presentations (really 20min w/ 10min of questions) on a whole range of threads that are being pulled together for this work. (I am going to link to these things but not today – you can google them for now if you really want to know more)
- TU-T SG13, SG 17 & ISO SC27 (IdM), Dick Brackney (USA), Tony Rutkowski(VeriSign)
- Content Industry standard identifier activities and Handles, Norman Paskin (ISO)
- 3GPP IDM Related Activities, Martin Euchner (Siemens)
- NGN Overview
- Liberty Alliance, Fulup Ar Foll (SUN)
- CardSpace and Identity Metasystem, Mike Jones (Microsoft)
- OpenID Presentation David Recordon (VeriSign)
- XRI (i-names) and XDI, Ajay Madhok
- Higgins, Presentation, Tony Nadalin (IBM)
- JCA-NID Presentation, Pierre-André Probst (OFCOM/Switzerland)
- OID Presentation, Olivier DUBUISSON (FT)
- Identity Commons overview, Kaliya Hamlin
- Privacy and Rights Management, Mary Rundle (Harvard)
Day 2 and 3 will be Open Space that I am facilitating and the 4th day we will coalesce into concrete working groups to move the deliverables forward between the end of the meeting and the next meeting likely in May in the Bay Area likely after IIW 2007.
Credit Checks by the Government 'legal'
More privacy invasion by the Executive Branch:
Vice President Dick Cheney said Sunday the Pentagon and CIA are not violating people’s rights by examining the banking and credit records of hundreds of Americans and others suspected of terrorism or espionage in the United States.
Rep. Silvestre Reyes, D-Texas, the new chairman of the House Intelligence Committee, said his panel will be the judge of that.
National security letters permit the executive branch to seek records about people in terrorism and spy investigations without a judge’s approval or grand jury subpoena.