From: Declan McCullagh <declan@well.com>
Date: Fri, 25 Jul 1997 00:31:51 +0800
To: cypherpunks@toad.com
Subject: EPIC Alert 4.11 (fwd)
Message-ID: <Pine.GSO.3.95.970724091421.25014D-100000@well.com>
MIME-Version: 1.0
Content-Type: text/plain





---------- Forwarded message ----------
Date: Thu, 24 Jul 1997 08:10:31 -0400
From: Dave Banisar <banisar@epic.org>




   ==============================================================

       @@@@  @@@@  @@@  @@@@      @    @     @@@@  @@@@  @@@@@
       @     @  @   @   @        @ @   @     @     @  @    @
       @@@@  @@@    @   @       @@@@@  @     @@@   @@@     @
       @     @      @   @       @   @  @     @     @  @    @
       @@@@  @     @@@  @@@@    @   @  @@@@  @@@@  @   @   @

   ==============================================================
   Volume 4.11	                                 July 23, 1997
   --------------------------------------------------------------

                            Published by the
              Electronic Privacy Information Center (EPIC)
                            Washington, D.C.

                          http://www.epic.org/

=======================================================================
Table of Contents
=======================================================================

[1] AOL to Sell Subscriber Telephone Numbers
[2] Search Engine Rating Scheme Touted at White House
[3] Another House Committee Approves SAFE Crypto Bill
[4] FTC Acts on Kids' Privacy
[5] Cellular Phone Group Asks FCC to Set Wiretap Standards
[6] New Bills in Congress
[7] New at the EPIC Bookstore
[8] Upcoming Conferences and Events

=======================================================================
[1] AOL to Sell Subscriber Telephone Numbers
=======================================================================

In a quiet change to its privacy policy, America Online will soon be
adding subscriber phone numbers to the list of personal information that
it sells to direct marketers.  The company may also match member lists
against "publicly available third-party data" to develop lists for
outside direct mail opportunities.  Previously, AOL's privacy policy
prevented the disclosure of subscriber telephone numbers, while allowing
the company to sell member names and addresses.

The new policy, which is to take effect on July 31, can be found in the
relatively obscure "Terms of Service" area of the online service.  No
notice of the new policy has been provided on the "Welcome" screen where
new AOL features are typically announced.  The revised policy states that

     We make our mailing list (name and address) available to
     select independent companies that offer products and information
     we think may interest you.  Additionally, we may make the list
     with telephone numbers available to companies with which AOL,
     Inc. has contractual marketing and online relationships for the
     purpose of permitting such companies to offer products and
     services over the telephone.  AOL, Inc. may also match the
     Member lists against publicly available third-party data
     (demographic information, areas of interest, etc.) to develop
     lists for use by these companies.

The new policy, which is to take effect on July 31, also points out that
AOL discloses individual information in an aggregated form in order to
describe its services to prospective partners, advertisers and other
third parties.  AOL may also use publicly available third-party data such
as demographic information and areas of interest to assist AOL in their
"programming, editorial research and to offer special opportunities to
our Members."

While AOL will generally not disclose "navigational" or "transactional"
information (such as where you go or what you buy through AOL) to third
parties, it may use such information to develop member lists for
companies with which AOL has a contractual marketing relationship.

For years (and most recently before the Federal Trade Commission),
industry has argued that self-regulation and not legislation is the only
way to ensure that businesses protect individual privacy in electronic
media.  If AOL's new privacy policy is representative of industry's
vision of what self regulation entails, users may have real cause for
concern.

More information on online privacy is available at:

     http://www.epic.org/privacy/

=======================================================================
[2] Search Engine Rating Scheme Touted at White House
=======================================================================

Leading industry groups suggested on July 16 that they may exclude
material from widely used search engines unless the authors agree to
attach subjective rating labels to all web pages and other online
information. Less than three weeks after the Supreme Court struck down
the Communications Decency Act, a far more sweeping proposal to restrict
information available on the Internet -- "filtering," "blocking" and
rating online content -- was touted at a White House summit meeting.

Announcing the Administration's "Strategy for a Family Friendly
Internet," President Clinton described the private sector initiative that
will presumably preclude the need for new content-control legislation:

     For ["family-friendly"] controls to work to their full
     potential, we also need to encourage every Internet site,
     whether or not it has material harmful for young people, to
     label its own content as the Vice President described just a
     few moments ago. To help to speed the labeling process along,
     several Internet search engines -- the Yellow Pages of
     cyberspace, if you will -- will begin to ask that all Web
     sites label content when applying for a spot in their
     directories.

     I want to thank Yahoo, Excite and Lycos for this important
     commitment. You're helping greatly to assure that self-
     labeling will become the standard practice. And that must
     be our objective.

While such an approach might seem preferable to CDA-type legislation at
first glance, it raises the specter of an Internet where only the
equivalent of "PG" rated content could be found through the search
engines users have come to depend on.  EPIC is encouraging users to
contact the search services and oppose such rating requirements as
fundamentally at odds with free speech principles.

More information on filtering/blocking/rating, and contact information
for the major search engines, is available at:

     http://www.epic.org/free_speech/censorware/

=======================================================================
[3] Another House Committee Approves SAFE Crypto Bill
=======================================================================

The House International Relations Committee approved the SAFE encryption
bill on July 22.  The legislation, which had already been approved by the
House Judiciary Committee, would substantially relax U.S. export controls
on encryption.  By a vote of 22-13, the committee rejected an amendment
offered by Chairman Benjamin Gilman (R-NY) that would have permitted the
President to maintain strict controls on the technology upon a finding
that "the export of such items would adversely affect the national
security."

The Committee's rejection of Gilman's amendment was particularly
significant, given that top officials from the FBI, National Security
Council and the Drug  Enforcement Agency took the unusual step of
appearing before the panel to warn that use of encryption by criminals
would hamper their ability to fight crime.  Secretary of Defense William
Cohen also transmitted a written appeal to the Committee members in which
he urged rejection of the SAFE bill.

While encryption reform efforts have moved forward in the House,
prospects in the Senate are less promising.  On June 18, the Senate
Commerce Committee approved the Secure Public Networks Act (S. 909),
which was introduced by Sens. Bob Kerrey (D-NE) and John McCain (R-AZ).
That bill contains a number of coercive measures that would force
widespread domestic adoption of key escrow encryption techniques

The SAFE bill will now be considered by the Commerce, National Security,
and Intelligence committees in the House, which are expected to vote on
the legislation by early September.

More information on the SAFE bill is available at:

     http://www.epic.org/crypto/

=======================================================================
[4] FTC Acts on Kids' Privacy
=======================================================================

The Federal Trade Commission has found that a web site which collects
data from kids and then sells it without notice is engaging in a
deceptive business practice in violation of the Federal Trade Commission
Act.

The Center for Media Education brought the complaint against KidsCom on
May 13, 1996, charging that the popular children's Web site was using
deceptive and unfair practices to market to children.  CME filed the
petition in an effort to address the growing problem of deceptive and
unfair marketing practices targeting children on the Web.

The Commission's action marks the first formal articulation of policy by
the agency's Bureau of Consumer Protection regarding what is permissible
when marketing to children online.  The FTC letter sets out broad
principles that apply generally to online information collection from
children. The FTC stated that:

     A practice is unfair under Section 5 if it causes, or is likely
     to cause, substantial injury to consumers which is not reasonably
     avoidable and is not outweighed by countervailing benefits to
     consumers or competition.(11) We believe that it would likely
     be an unfair practice in violation of Section 5 to collect
     personally identifiable information, such as name, e-mail
     address, home address or phone number, from children and
     sell or otherwise disclose such identifiable information to
     third parties without providing parents with adequate notice,
     as described above, and an opportunity to control the
     collection and use of the information.

Because KidsCom changed the operation of its website after the CME
complaint was filed, the FTC said that it would take no enforcement
action. The FTC letter concluded:

     We will continue to monitor KidsCom, as well as other
     commercial Web site operators, to ascertain whether they may
     be engaged in deceptive or unfair practices. Hereafter, staff
     may recommend law enforcement proceedings against marketers
     who engage in deceptive information practices, or who unfairly
     use personally identifiable information collected from
     children.

FTC Letter Ruling is available at:

     http://www.ftc.gov/os/9707/cenmed~1.htm

CME Statement is available at:

     http://tap.epn.org/cme/ftc716.html

=======================================================================
[5] Cellular Phone Group Asks FCC to Set Wiretap Standards
=======================================================================

The Cellular Telephone Industry Association (CTIA) on July 16 asked the
Federal Communications Commission to step in to help develop the
standards for wiretapping under the Communications Assistance for Law
Enforcement Act (CALEA).  The telephone industry and the FBI have been
quietly meeting for two years to develop the new standards required by
the law.  The CTIA is objecting to additional FBI demands not included in
the law such as that cellular phones function as tracking devices.

In a July 15 letter to FBI Director Louis Freeh, the head of CTIA, Thomas
Wheeler, called the FBI position "intractable" and detailed how FBI and
law enforcement objections prevent an industry-sponsored standard from
being adopted.  In response, the Bureau called the CTIA action a "short
circuit" of the standards process and denied that it was seeking
additional powers.  Both the industry position and the FBI demands are
problematic from a privacy perspective, as both would facilitate easier
wiretapping and the collection of transactional information.

CALEA requires that all telecommunications providers redesign their
systems by October 1998 to make wiretapping of new communications
technologies easier.  Phone companies are eligible to receive $500
million from the FBI to implement the new systems.

More information on CALEA and wiretapping is available from:

     http://www.epic.org/privacy/wiretap/

=======================================================================
[6] New Bills in Congress
=======================================================================

H.R. 2180. On-Line Copyright Liability Limitation Act.  Would limit
liability for online service providers that are not aware that
copyrighted materials are going over their networks.  Introduced by Rep.
Coble (R-NC) on July 16. Referred to the Committee on the Judiciary.

H.R.2198.  Genetic Privacy and Nondiscrimination Act of 1997.  Would
limit use and disclosure of genetic information by health insurance
companies; prohibit employers from attempting to acquire, or to use,
genetic information, or "to require a genetic test of an employee or
applicant for employment" or to disclose the information.  Introduced by
Rep. Stearns (R-FL) on July 17.  Referred to the Committee on Commerce,
and in addition to the Committees on Government Reform and Oversight,
Education and the Workforce, and Veterans' Affairs.

An up-to-date list of pending legislation is available at:

     http://www.epic.org/privacy/bill_track.html

=======================================================================
[7] New at the EPIC Bookstore
=======================================================================

The EPIC Bookstore includes a wide range of books on privacy,
cryptography and free speech that can be ordered online.  Many of the
books are available at up to 40 percent off list price.

New titles include:

  "Protect Your Privacy on the Internet" by Bryan Pfaffenberger

  "Digital Cash" by Peter Wayner

  "Contested Commodities" by Margaret Jane Radin

Other popular titles:

  "The Right to Privacy" by Ellen Alderman & Caroline Kennedy

  "Who Knows: Safeguarding Your Privacy in a Networked World"
   by Ann Cavoukian & Don Tapscott

  "Applied Cryptography, 2nd Edition" by Bruce Schneier

We are also now featuring _The Tin Drum_ by Gunther Grass.  The novel, a
bizarre but extraordinary diary of a young boy who refuses to grow up
during the rise and fall of Nazi Germany, is considered by some the
greatest German novel written since WWII.  In 1979, the film version of
the Tin Drum received an Academy Award for Best Foreign Film.  However,
in recent months, groups that oppose "pornography" have persuaded the
Oklahoma City Library to remove copies of the film from the public
library.  For this reason, we are now making the book available at the
EPIC Bookstore.

Support the Freedom to Read.

Check out the EPIC Bookstore at:

     http://www.epic.org/bookstore/

=======================================================================
[8] Upcoming Conferences and Events
=======================================================================

Hacking In Progress. August 8-10, 1997. Almere, Netherlands. Sponsored by
Hac-Tic. Contact: http://www.hip97.nl/

Beyond HOPE. August 8-10, New York City. Sponsored by 2600. Contact:
http://www.2600.com.

TELECOM Interactive 97.  September 8-14, 1997. Geneva, Switzerland.
Sponsored by the International Telecommunications Union.  Contact:
telecom-interactive@itu.int or http://gold.itu.int/TELECOM/int97/

Cryptography and The Internet: Developing Privacy and Security Policy
for the European Information Society. September 15, 1997. Brussels,
Belgium. Sponsored by Privacy International. Contact: ast3@privacy.org.
http://www.privacy.org/pi/conference/brussels/

19th Annual International Privacy and Data Protection Conference.
September 17-18, 1997. Brussels, Belgium. Sponsored by Belgium Data
Protection and Privacy Commission. Email privacy@infoboard.be

International Conference on Privacy. September 23-26, 1997. Montreal,
Canada. Sponsored by Lavery, de Billy (corporate law firm).
http://www.confpriv.qc.ca/

Managing the Privacy Revolution '97. October 21-23, 1997. Washington, DC.
Sponsored by Privacy and American Business. Contact:
http://shell.idt.net/~pab/conf97.html

RSA'98 -- The 1998 RSA Data Security Conference.  January 12-16, 1998.
San Francisco, CA.  Contact kurt@rsa.com or http://www.rsa.com/conf98/


             (Send calendar submissions to alert@epic.org)

=======================================================================

The EPIC Alert is a free biweekly publication of the Electronic Privacy
Information Center.  To subscribe, send email to epic-news@epic.org wih
the subject: "subscribe" (no quotes) or use the subscription form at:

      http://www.epic.org/alert/subscribe.html

Back issues are available at:

      http://www.epic.org/alert/

=======================================================================

The Electronic Privacy Information Center is a public interest research
center in Washington, DC.  It was established in 1994 to focus public
attention on emerging privacy issues such as the Clipper Chip, the
Digital Telephony proposal, national ID cards, medical record privacy,
and the collection and sale of personal information.  EPIC is sponsored
by the Fund for Constitutional Government, a non-profit organization
established in 1974 to protect civil liberties and constitutional
rights.  EPIC publishes the EPIC Alert, pursues Freedom of Information
Act litigation, and conducts policy research.  For more information,
e-mail info@epic.org, http://www.epic.org or write EPIC, 666
Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240
(tel), +1 202 547 5482 (fax).

If you'd like to support the work of the Electronic Privacy Information
Center, contributions are welcome and fully tax-deductible.  Checks
should be made out to "The Fund for Constitutional Government" and sent
to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003.
Individuals with First Virtual accounts can donate at
http://www.epic.org/epic/support.html

Your contributions will help support Freedom of Information Act and
First Amendment litigation, strong and effective advocacy for the right
of privacy and efforts to oppose government regulation of encryption and
funding of the National Wiretap Plan.

Thank you for your support.

  ---------------------- END EPIC Alert 4.11 -----------------------

..

-------
David Banisar (Banisar@epic.org)                *    202-544-9240 (tel)
Electronic Privacy Information Center           *    202-547-5482 (fax)
666 Pennsylvania Ave, SE, Suite 301             *    HTTP://www.epic.org
Washington, DC 20003 * PGP Key  http://www.epic.org/staff/banisar/key.html