From: Dave_Banisar.OFFICE@epic.org
Date: Tue, 7 Feb 95 15:55:42 PST
To: "CPSR  Listserv" <cpsr-announce@cpsr.org>
Subject: EPIC Alert 2.02
Message-ID: <n1419939228.95186@epic.org>
MIME-Version: 1.0
Content-Type: text/plain


    =============================================================
      
       @@@@  @@@@  @@@  @@@@      @    @     @@@@  @@@@  @@@@@
       @     @  @   @   @        @ @   @     @     @  @    @
       @@@@  @@@    @   @       @@@@@  @     @@@   @@@     @
       @     @      @   @       @   @  @     @     @  @    @
       @@@@  @     @@@  @@@@    @   @  @@@@  @@@@  @   @   @

   ==============================================================
   Volume 2.02                                   February 6, 1995
   --------------------------------------------------------------
  
                        Published by the
           Electronic Privacy Information Center (EPIC)
                         Washington, DC
                          info@epic.org

=======================================================================
Table of Contents
=======================================================================

 [1] IRS Backs Off Compliance 2000 Program
 [2] New Secrecy Order Needs Work
 [3] Caller ID Blocking Fails in New York
 [4] Post Office Partially Limits Access to Addresses
 [5] Clinton Announces National ID Registry
 [6] Correction: EU Directive Still Under Consideration
 [7] Overview of New Congressional Privacy Legislation
 [8] Upcoming Conferences and Events

=======================================================================
[1] IRS Backing Off of Compliance 2000 Program
=======================================================================

The Internal Revenue Service announced on Friday, January 20, that it
was delaying implemention of the controversial Compliance 2000 program
after heated opposition to the proposal from the Electronic Privacy
Information Center (EPIC) and other privacy advocates appeared in over
two dozen newspapers across the country.  The proposal also drew sharp
criticism from Senator David Prior.  The plan called for IRS
collection and use of personal information from commercial databases.
This data would not be subject to the requirements of the Privacy Act.

IRS officials told the EPIC Alert that the Compliance 2000 notice
published in the Federal Register was going to be revised in the next
few weeks and then reissued.  IRS Privacy Advocate Robert Veeder said
that the notice had been drafted more than a year ago and that the
program had been revised substantially since then.

EPIC has filed a Freedom of Information Act request with the IRS,
asking for more information about the types of data that would be
collected if Compliance 200 goes forward, the sources of the
information and the proposed uses.


=======================================================================
[2] Draft Secrecy Order Still Needs Work
=======================================================================

The White House recently circulated the latest draft of the
President's long-awaited revised Executive Order on the classification
of national security information.  The current version back-pedals on
favorable proposed reforms of the classification system, retreating
from an earlier proposal that prohibited secrecy when the "public
interest in keeping the information unclassified outweighs the need
for classification."  Such a standard would permit the public and the
news media to challenge classification decisions in court.  The draft
also fails to go far enough in opening the government's civilian
cryptographic activities to public scrutiny.

Efforts to revise the current Executive Order (issued by President
Reagan in 1982) began almost two years ago, soon after the Clinton
Administration assumed office.  Several drafts have circulated since
then, and the issuance of a final revision was anticipated more than a
year ago.  The Center for National Security Studies, the Federation of
American Scientists, the National Security Archive, and EPIC have all
urged the relaxation of classification authority.

EPIC has specifically recommended that classification be removed for
cryptographic information.  In comments submitted to the Information
Security Oversight Office in July 1993, EPIC staff urged removal of
"cryptology" from the categories of information presumed to be
classifiable.  The statement said that the "designation of a routine
privacy-enhancing technology as presumptively a national security
matter is inconsistent with the end of the Cold War and the dramatic
growth of commercial and civilian telecommunications networks.  ...
[Cryptographic] technology today plays an essential role in assuring
the security and privacy of a wide range of communications affecting
finance, education, research, and personal correspondence."

The recent Clinton proposal does indeed narrow the government's
classification authority for "cryptology", although the final order
should go further.  Under the original Reagan Order, "cryptology" was
singled out as a separate and independent category. The recent draft
drops cryptology as an independent category and instead refers
generally to "intelligence activities (including special operations),
intelligence sources or methods, or cryptology."

This formulation suggests a recognition that information concerning
encryption technology should only be classified if it relates to
intelligence uses of the technology, as opposed to the increasing use
of encryption in civilian applications.  The language, however, leaves
open the possibility that the government might still attempt to
classify information relating to cryptography.  This position  does
not comport with the overwhelming opinion outside of government that
cryptography  should never be presumptively classified.

The classification of cryptographic information has already hampered
the public's ability to monitor the government's activities in the
area of civilian communications security.  Information relating to the
Digital Signature Standard (intended for the authentication of
unclassified electronic transmissions) has been withheld from
disclosure under the Reagan Executive Order.  Likewise, key
information concerning the Clipper encryption initiative (including
the underlying Skipjack algorithm) has been classified and placed
beyond public review.

Congress sought to prevent such secrecy when it enacted the Computer
Security Act of 1987, which limited the civilian role of the National
Security Agency (NSA).  Congress noted that NSA's "natural tendency to
restrict and even deny access to information that it deems important
would disqualify that agency from being put in charge of the
protection of non-national security information."  The Clinton
Administration, through further revision of its draft Executive Order,
has an opportunity to build upon the openness and accountability that
Congress envisioned.


=======================================================================
[3] Caller ID Blocking Fails in New York
=======================================================================

NYNEX has admitted that the personal phone numbers of at least 30,000
of its customers who requested per-line blocking of Caller ID have
been improperly disclosed.  The problem resulted from a failure to
correctly implement the blocking feature. The New York Times reports
that NYNEX had known of the problem for at least a year before any
action was taken.

The Rhode Island Public Utilities Commission has ordered NYNEX not to
allow customers in that state to order new Caller ID services or per
line blocking until the problem is resolved.  NYNEX must also run ads
telling customers about the problem and provide an 800 number for
consumers to call.

EPIC has received several calls from individuals in New York who have
had their phone numbers disclosed.  The individuals work in sensitive
jobs and have already received threatening phone calls as a result of
the disclosures.


=======================================================================
[4] Post Office Partially Limits Access to Addresses
=======================================================================

The U.S. Postal Service announced on December 28 its final rule on
access to names and addresses.  The agency announced it was
eliminating the service that allows anyone to obtain the new address
of any individual for a $3.00 fee.  The Postal Service, however, left
intact its service that provides the addresses of all postal customers
to large mailers such as direct marketers.

The notice states "Congress has not given the Postal Service the
function of serving as a national registration point for the physical
whereabouts of individuals."

HR 434, The Postal Privacy Act of 1995, (introduced by Rep. Gary
Condit) requires that the Postal Service inform individuals of the
uses of information contained in Change of Address cards and mandates
that customers be offered an option to not have their names and
addresses forwarded.


=======================================================================
[5] Clinton Announces National ID Worker Registry
=======================================================================

In the annual State of the Union address on January 25, President
Clinton announced his support for the creation of a national registry
of all citizens and resident aliens to enforce immigration laws.  The
idea was recommended the U.S. Commission on Immigration Reform, headed
by former Rep. Barbara Jordan.

The proposal would create a national database of all employees based
on Social Security Numbers that every employer would be required to
check before hiring.  Civil liberties groups believe that this
database, once in place, would then be used for other purposes, such
as law enforcement, and would eventually lead to the development of a
national ID card.  The Commission has previously considered requiring
the creation of an ID card but backed off in the face of public
opposition.

Senator Alan Simpson (R-WY) has introduced a bill (S. 269) to
implement the registry.  Sen. Barbara Boxer (D-CA) told USA Today that
Congress was planning to address the issue and that the system is the
only way to provide accurate citizenship information and protect
privacy.


=======================================================================
[6] Overview of New Congressional Privacy Legislation Available
=======================================================================

EPIC has produced an overview of current privacy legislation in the
104th Congress.  Bills that improve privacy protections or negatively
affect privacy are summarized.  The summary will be updated regularly
as new legislation is introduced or pending bills are revised. A
summary will appear in the next issue of the EPIC Alert.

Copies of the new bills are available for retrieval from the EPIC
Archive at cpsr.org.  Also included are floor statements on the
legislation when available and updates on the status of the bills.

To obtain the overview and copies of the house and Senate bills,
ftp/gopher/wais to cpsr.org /cpsr/privacy/epic/104th_congress_bills/


=======================================================================
[7] Upcoming Privacy Related Conferences and Events
=======================================================================

AAAS Annual Meeting & Science Innovation Expo.  Atlanta. Feb 16-21. A
special full-day session on cryptography and privacy will take place
on Tuesday, Feb. 21. Contact: Alex Fowler 202/326-7016 or
afowler@aaas.org

Cryptography: Technology, Law and Economics. New York City. Mar. 3,
1995. Sponsored by CITI, Columbia University. Contact:
citi@research.gsb.columbia.edu

Towards an Electronic Patient Record '95. Orlando, FL. Mar. 14-19,
1995. Sponsored by Medical Records Institute. Contact: 617-964-3926
(fax).

Access, Privacy, and Commercialism:  When States Gather Personal
Information. College of William and Mary, Williamsburg, VA, March 17.
Contact:  Trotter Hardy  804 221-3826.

Computers, Freedom and Privacy '95. Palo Alto, Ca. Mar. 28-31, 1995.
Sponsored by ACM. Contact: cfp95@forsythe.stanford.edu.

ETHICOMP95:  An international conference on the ethical issues of
using Information Technology. DeMontfort University, Leicester,
ENGLAND, March 28-30, 1995.  Contact: Simon Rogerson srog@dmu.ac.uk 44
533 577475 (phone)  44 533 541891 (Fax).

"Quality of Life in the Electronic Village," March 30, 1995. Live
teleconference, broadcast nationally from Virginia Tech, featuring
eminent presenters from the fields of ethics, law, education,
anthropology, medicine, and government.  Contact 703/231-6476 or
choices@vt.edu.

National Net '95: Reaching Everyone. Washington, DC.  Apr. 5-7, 1995.
Sponsored by EDUCOM.  Contact: net95@educom.edu or call 202/872-4200.

Information Security and Privacy in the Public Sector. Herndon, VA.
Apr. 19-20, 1995. Sponsored by AIC Conferences.  Contact:
212/952-1899.

1995 IEEE Symposium on Security and Privacy. Oakland, CA, May 8-10.
Contact:  sp95@itd.nrl.navy.mil.

INET '95. Honolulu, HI. June 28-30, 1995. Sponsored by the Internet
Society. Contact inet95@isoc.org.

Key Players in the Introduction of Information Technology: Their
Social Responsibility and Professional Training. July 5-6-7, 1995.
Namur, Belgium. Sponsored by CREIS. Contact: nolod@ccr.jussieu.fr.

Advanced Surveillance Technologies. Sept. 4-5, 1995. Copenhagen,
Denmark. Sponsored by Privacy International and EPIC. Contact
pi@epic.org.

          (Send calendar submissions to Alert@epic.org)
  
=======================================================================

The EPIC Alert is a free biweekly publication of the Electronic
Privacy Information Center. To subscribe, send the message:

SUBSCRIBE CPSR-ANNOUNCE Firstname Lastname

to listserv@cpsr.org. You may also receive the Alert by reading the
USENET newsgroup comp.org.cpsr.announce.

Back issues are available via FTP/WAIS/Gopher/HTTP from cpsr.org
/cpsr/alert and on Compuserve (Go NCSA), Library 2 (EPIC/Ethics). An
HTML version of the current issue is available from
epic.digicash.com/epic

=======================================================================

The Electronic Privacy Information Center is a public interest
research center in Washington, DC.  It was established in 1994 to
focus public attention on emerging privacy issues relating to the
National Information Infrastructure, such as the Clipper Chip, the
Digital Telephony proposal, medical record privacy, and the sale of
consumer data.  EPIC is sponsored by the Fund for Constitutional
Government and Computer Professionals for Social Responsibility.  EPIC
publishes the EPIC Alert and EPIC Reports, pursues Freedom of
Information Act litigation, and conducts policy research on emerging
privacy issues.  For more information, email info@epic.org, WWW at
HTTP://epic.digicash.com /epic or write EPIC, 666 Pennsylvania Ave.,
SE, Suite 301, Washington, DC 20003. (202) 544-9240 (tel), (202)
547-5482 (fax).

The Fund for Constitutional Government is a non-profit organization
established in 1974 to protect civil liberties and constitutional
rights.  Computer Professionals for Social Responsibility is a
national membership organization of people concerned about the impact
of technology on society.  For information contact: cpsr-info@cpsr.org

If you'd like to support the work of the Electronic Privacy
Information Center, contributions are welcome and fully
tax-deductible.  Checks should be made out to "The Fund for
Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave.,
SE, Suite 301, Washington DC 20003.

Your contributions will help support Freedom of Information Act
litigation, strong and effective advocacy for the right of privacy and
efforts to oppose Clipper and Digital Telephony wiretapping proposals.

------------------------ END EPIC Alert 2.02 ------------------------







_________________________________________________________________________
Subject: EPIC Alert 2.02
_________________________________________________________________________
David Banisar (Banisar@epic.org)       * 202-544-9240 (tel)
Electronic Privacy Information Center * 202-547-5482 (fax)
666 Pennsylvania Ave, SE, Suite 301  * ftp/gopher/wais cpsr.org 
Washington, DC 20003                * HTTP://epic.digicash.com/epic