Privacy and Computers CS 215 © Denbigh Starkey 1. Introduction 1 2. Family Education Rights and Privacy Act (FERPA) 2 3. Electronic Freedom Foundation (EFF) 4 4. Protecting Your Privacy. EFF Recommendations 4 5. Security Breaches and State Laws 12 6. State Security Freeze Laws 14 7. Legal Right to Privacy 15 8. Mining Private Data 16 9. Clipper Chip 17 1. Introduction Say that you are considering renting out your house to a couple and they currently live out of town. They might seem like nice people when you talk to them on the phone, but you don’t know them, and so before the introduction of computer information you’d maybe have asked for references, and if those came in looking good you’d hope that they weren’t faked and rent out the house to the couple. Another alternative would have been to hire an investigator in their current home town, but that was so expensive as to be prohibitive. Now things have changed. A few days ago I needed an address for one of our former faculty members who retired and moved to Arizona. I entered her name in www.whitepages.com and selected Arizona, and it came back with the address and telephone number for her and her husband. So far, no problem. This very fast search has saved me guessing and trying a large number of Arizona telephone books at the library. However the page also has a button telling me that more information is available on her. Being curious I click that and it has a link which gives me the addresses (e- and street) of her neighbors. So now I can phone these people and ask them how well our former faculty member looks after their house, whether they have loud parties all of the time, and so on. Also, the page gives me a link where I can do a background check on our former faculty member and her husband, which includes “Criminal Check, Sex Offender Check, Bankruptcies, Tax Liens, Legal Judgments, Current & Previous Addresses, Alias Names, Roommates, Relatives, Family Members, Neighbors, Property Ownership, Mortgage Data, & more personal profile information.” This would cost me $49.95. If their phone number is unlisted than it appears that What has happened is that online databases have let me get information about anyone, far faster and dramatically cheaper, than I would have been able to get a few years ago. Clearly there has been a loss of privacy, but it is unclear whether overall this is good or bad. E.g., should the students in the CS 215 class be able to pay $2.50 each and share the cost to find out all of this information on me, or should they only be able to find out whether I’ve got a criminal record if they have good reason to know? On the other hand, if I’m hiring a baby sitter then knowing whether or not they are a sex offender could be very important to me. Another problem, of course, is how do I find out whether the information about me on different systems is even accurate? If, for example, it somehow confused me with some other Denbigh Starkey and listed me as a sex offender, would I ever even know why I was always being turned down for jobs? The remainder of these notes will look at privacy issues from different standpoints. The FERPA legislation will discuss your rights as students. I’ll include the EFF recommendations on how to protect yourself from identity theft and look at state security breach and freeze laws. The other major section will be on the legal right to privacy in the US and the case that began the discussion, Griswold vs. Connecticut. 2. Family Education Rights and Privacy Act (FERPA) As computers have tended to reduce privacy, a number of attempts have been made to help to protect individuals from loss of privacy and from related issues like identity theft. In education a landmark bill was the Family Education Rights and Privacy Act, also known as FERPA or the Buckley Amendment after the primary author. Essentially FERPA lets parents and children inspect school education records and to request that any errors be corrected. If the school rejects a change request then formal hearings are required. This applies until the student either reaches age 18 or attends a school past the high school level, in which case all rights pass to the student and parents lose all these rights. Other than that the school cannot release any academic records except under very specific circumstances, which the bill lists as: a) School officials with legitimate educational interest; b) Other schools to which a student is transferring; c) Specified officials for audit or evaluation purposes; d) Appropriate parties in connection with financial aid to a student; e) Organizations conducting certain studies for or on behalf of the school; f) Accrediting organizations; g) To comply with a judicial order or lawfully issued subpoena; h) Appropriate officials in cases of health and safety emergencies; and i) State and local authorities, within a juvenile justice system, pursuant to specific State law. 2 Some of these restrictions become complicated to enforce. E.g., as a school official whose records should I have access to? Before we had computerized records there were copies of transcripts in departmental offices and in the Registrar’s Office. This provided pretty good protection for transcripts. Now transcripts are only online, and so what should I be able to access. I presumably need to access records for my advisees, but advising assignments can be fairly informal and often students come in to see me for advice who are technically assigned to someone else, or a student will come in from another department who is considering switching to CS, and I need to advise them on what requirements they have already satisfied. So MSU has taken the position that faculty, through the secure area of MyInfo, should have access to the transcripts of all students at MSU, and expect us to follow the FERPA requirements. If, however, I were to release a student’s transcript to someone unauthorized then I suspect that not only would I be liable, but MSU would be as well. Another part of FERPA is: Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school. This seems fairly clear, but universities have not always been sufficiently careful. E.g., when I was at WSU a student had requested a block on release of any information about her because she had been stalked in her home town, and was basically hiding in Pullman. Unfortunately she got a straight A average one semester, and so the computer sent a letter to her home newspaper with honor roll information. This forced her to leave Pullman and move to another out of state university, and when I left MSU a lawsuit had been initiated. Most of the time we go as far as possible to meet not only the requirements of FERPA but also the intent behind the legislation. E.g., when we give examples of student work and transcripts to ABET, our accreditation agency, we black out student names, even though this is a permitted disclosure under the FERPA regulations. 3 3. Electronic Freedom Foundation The primary organization dedicated to protecting online privacy and other online freedoms is the Electronic Freedom Foundation. Their Web page is at www.eff.org. This is the first source of information for most online freedom issues because although they tend to strongly oppose most government regulations, including many provisions of the Patriot Act, they provide good links to source materials on most issues. So using their page will let you get to the information that you need to form your own views on most online freedom issues. I’ll start by discussing their recommendations for protecting your online privacy. 4. Protecting Your Privacy – EFF Recommendations The Electronic Freedom Foundation has twelve recommended steps to help you to protect your online privacy. I’m directly quoting them below because they are far more comprehensive than anything I could have come up with. After reading through them I’m somewhat distressed at how poor a job I do at protecting myself much of the time, and intend to improve. 1) Do not reveal personal information inadvertently. You may be "shedding" personal details, including e-mail addresses and other contact information, without even knowing it unless you properly configure your Web browser. In your browser's "Setup", "Options" or "Preferences" menus, you may wish to use a pseudonym instead of your real name, and not enter an e-mail address, nor provide other personally identifiable information that you don't wish to share. When visiting a site you trust you can choose to give them your info, in forms on their site; there is no need for your browser to potentially make this information available to all comers. Also be on the lookout for system-wide "Internet defaults" programs on your computer (some examples include Window's Internet Control Panel, and MacOS's Configuration Manager, and the third-party Mac utility named Internet Config).