US_E_04 03.4.2 12:35 ページ63 A Report of International Research on Privacy for Electronic Government Contact: Lauren Weinstein Privacy Issues and Privacy l a u r en@ p f i r . o r g Peter G. Neumann Enhancing Technologies [email protected] Cameo Wood by Lauren Weinstein and Peter G. Neumann [email protected] 15 February 2003 Ad d i t i o n by Cameo Wood Co n t e n t s Ab s t r a c t Introduction and Executive Summary SSNs and Other Identification Schemes Summary of Information System Privacy Issues Privacy-Enhancing Technologies and Their Limitations ID Card Systems Bi o m e t r i c s Total Information Awareness (TIA) En c r y p t i o n Internet Privacy Issues Telephone and Pager Communications Privacy Issues Monitoring and Surveillance Internet Monitoring Anomaly and Misuse Detection, and Response Illustrative Cases of Identity and Privacy Risks Privacy Laws Co n c l u s i o n s Selected Bibliography Appendix: Glossary of Terms Addition: Specific Tech Issues Addition: Use Case of Electronic Voting and its voter privacy protection method Privacy Issues and Privacy Enhancing Technologies —— 63 US_E_04 03.4.2 12:35 ページ64 A Report of Research on Privacy for Electronic Government Ab s t r a c t (however, useful and laudable they may ostensibly appear from a public relations and political standpoint) but that actu- This report considers the state of privacy issues and major ally merely crush civil liberties and move toward a police sources of privacy problems in the United States (and related state society. international issues), summarizes the most important poten- Traditionally, public-record information such as birth, tial privacy-enhancing technologies, and illustrates the major death, court, and a wide range of other government records risks through cases of serious violations of privacy that have becomes the fodder for massive abuse (on the part of both been reported. It also considers the sorts of problems that the public and private sectors) when it becomes easily acces- should be expected in the near future if current anti-privacy sible en masse through database systems, sometimes even trends continue. Most of these issues will be applicable on an being treated as a profit center by government agencies. The international basis, and may be of serious concern in Japan. same information that was relatively harmless on index cards in a card file (which required significant effort to research and obtain) becomes qualitatively changed by the kind of access that computers and databases provide to the data. Introduction and Executive Summary Furthermore, the potential for resulting problems is gigantic. Businesses tend to treat the personal information of Privacy is a concept with many different meanings to people their customers as a mere commodity — like potatoes or hog and cultures around the world. To some persons, it means the bellies — to be traded, sold, and exploited massively with no freedom to be “left alone” so long as their activities don’t real control (or even knowledge of these actions) on the part impinge upon the rights of others. Privacy can also connote of the customers themselves whose data is being manipulat- protection of information from misuse or abuse, especially ed and often abused in these ways. when that information is stored in computers and transmitted In the United States, a confused hodgepodge of con- through communications media. flicting laws and regulations at the federal, state, and local While persons living in small towns one hundred years levels has created an terrible mess when it comes to privacy might have had little expectation of privacy in the sense we issues. Businesses pretty much run the show, with little real think of it today (after all, everybody knew what everyone concern about consumer rights beyond that absolutely neces- else was doing then!) in our modern societies an expectation sary to meet the weak and limited government regulations of greater privacy has arisen along with the rise of our tech- that exist in specific areas like the credit and financial servic- nological prowess — at least until relatively recently. es sectors. Large portions of the most privacy-invasive The ability of modern computers, databases, and aspects of business, including the Internet, are still largely telecommunications systems to integrate and “data-mine” unregulated and privacy abuses have been rising in all of personal data in ways unimaginable even ten or twenty years these areas at an extremely alarming rate. ago is vast, and bring with it enormous opportunities for The U.S. provides in some respects an excellent neg- abuse and misuse. ative example — namely, how not to deal with privacy Making matters worse, the legal and judicial systems in concerns — at least in comparison with some countries most countries have not kept pace with these developments, (such as those of the European Economic Community). perpetually being in a state of playing “catch up” to fix priva- That’s not to say that the EEC has done everything right in cy abuses after they’ve occurred, rather than taking a proac- this regard. Some of their (especially recent) actions tive stance that might have protected the privacy of its citi- regarding privacy and surveillance are extremely negative zens and other residents in the first place. Often by the time themselves. However, the EEC has at least started down such corrective actions are taken (to whatever extent those the path to defining privacy issues in a systematic and actions exist), the personal data involved may already be broadly applicable manner, a path the U.S. stubbornly widely abused; no practical means exist to “take back” that refuses to really consider. data and protect it again retroactively. Personal data once In the wake of the terrorist attacks of September 11, revealed is usually revealed effectively forever. 2001, and the U.S.’s new infatuation with preemptive war as Powerful interests in government and business are also a global “stabilization” technique, many entities with highly responsible for making the privacy situation worse. anti-privacy agendas have seen new life in their old propos- Governments may use security concerns as an excuse for als. Formerly unable to get their draconian agendas enacted anti-privacy actions that do little to increase real security into law, they’re now seeing success in exploiting the “war 64 —— Privacy Issues and Privacy Enhancing Technologies US_E_04 03.4.2 12:35 ページ65 A Report of Research on Privacy for Electronic Government on terror” as an excuse for enacting all manner of anti-civil- required to display the actual card. liberties and anti-privacy measures, most of which will not The ostensible purpose of the SSN is to provide a actually fight terrorism in any significant way. means to record and track a person’s financial activity, par- It’s a bad time for privacy. ticularly for tax purposes. Virtually all of a persons’ federal Most people never really even consciously think about and state income tax and other tax liabilities and records, are privacy matters to begin with until their privacy has been indexed by the nine-digit SSN. eroded, and that loss usually occurs little by little over a long The name “Social Security” relates to the fact that the period of time, with potentially devastating results. number was originally created to facilitate not only the col- Protecting privacy takes a great deal of diligence, lection of taxes but also the distribution of all old-age and work, dedication, and perseverance, especially in the face of other related benefits that are part of the Social Security increased computerization, cross-linking of information data- system. bases, dependence on the Internet, and ever-growing efforts However, in the decades since the Social Security to misuse existing and new information and data for both Number’s appearance, the SSN has gradually become used public and private-sector purposes. as a universal identifier for all manner of transactions, many Many of these related problems are discussed in this of which have absolutely nothing to do with taxes or other report, including difficulties associated with personal identi- government activities. This has led to the Social Security ties, computer databases, and many related issues. In addi- number being abused widely and becoming a primary factor tion to identifying the areas of concern, we have endeavored in the spread of identity fraud which has now reached astro- to note the roles that technology could play in helping protect nomic proportions. privacy, assuming an environment that permitted and Because the Social Security number is not generally encouraged their use. We have also included various exam- considered to be confidential information (particularly as a ples of privacy problems and related risks that have occurred result of relatively recent court actions) a vast array of non- in the past, in the hope that these may be of assistance in governmental organizations, businesses, and even individu- illustrating the risks that are now faced by individuals, organ- als, use the Social Security number to provide a means for izations, and even governments today and in the near future. both record-keeping and investigatory purposes whether A glossary of specialized definitions used in this report legitimate or not. Not only does the U.S. Social Security card is provided as an appendix. These terms relate to identities, not include any form of biometric identification, it does not authentication, authorization, accountability, anonymity, even include a photograph, further emphasizing the fact that pseudoanonymity, and other associated areas. it is not actually an identification card of any kind. Since this report is of necessity limited in length, it can Due to lax controls over the purposes to which the SSN only cover these complex topics relatively briefly.