Category Archives: Privacy and Security

As part of the President’s Executive Order on Cybersecurity, the National Institute of Standards and Technology (NIST) is required to develop a Cybersecurity Framework (Framework). This Framework, per Section 7 of the Executive Order, would “include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks.” [...]

On April 10 the House Intelligence Committee will review H.R. 624, the Cyber Intelligence Sharing and Protection Act. The Committee approved an almost identical bill last year, and USACM released a statement expressing serious concerns with the bill. While press reports indicate that several amendments will be up for consideration during tomorrow’s hearing, the text [...]

On Thursday Senator Rockefeller of West Virginia introduced legislation to establish an option for people to opt out of tracking their online activity. It is S.418 and can be reviewed online. The Senator introduced a similar bill in 2011. He did not vigorously pursue the measure, in part because of efforts by several parties to [...]

On Tuesday, as part of the State of the Union address, President Obama issued an executive order on cybersecurity. The order focuses on the cybersecurity of critical infrastructure – defined in the order as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems [...]

On Wednesday the Federal Trade Commission (FTC) announced the final updated rules for implementing the Children’s Online Privacy Protection Act (COPPA). Passed in 1998, COPPA rules had not been updated to reflect changes in technology, most notably the rise of mobile internet access and mobile applications. The final rules will take effect on July 1, [...]

In late April the House considered and passed several pieces of cybersecurity legislation. At the time USACM released a statement with general recommendations for cybersecurity bills. Of the bills that passed the House, H.R. 3523, the Cyber Intelligence Sharing and Protection Act (CISPA), has attracted the most concern. The bill is currently in the Senate [...]

Yesterday the Federal Trade Commission (FTC) released the final version of its report on consumer privacy online. It issued a draft report in December 2010 and received over 450 comments in response, including those filed by USACM. The final report retains the same general framework outlined in the December 2010 draft, and is broadly consistent [...]

What follows is a guest post from Chris Bronk, Information Technology Policy Fellow at Rice University’s Baker Institute for Public Policy. He’s a new member of USACM, but the post reflects only his thoughts on the Cybersecurity Act of 2012, and not necessarily those of USACM. Digesting the New Senate Cybersecurity Legislation by Chris Bronk [...]

Like many federal agencies, the Social Security Administration (SSA) is trying to provide more services in a time of limited resources. As part of its efforts to better serve the public, the SSA is working on an online authentication system to help ensure that the people it is interacting with online are indeed the people [...]

Congress has been making noise about passing comprehensive cybersecurity legislation for most of the last two years, prompted in part by the Obama Administration’s cyberspace policy review in 2009. Nearly two years later, the Administration has released a legislative proposal in cybersecurity that may help push legislation further along. Depending on how you count, there [...]

Last Friday the Obama Administration released its National Strategy for Trusted Identities in Cyberspace (NSTIC), a plan to leverage private sector tools to make it easier for some kinds of transactions to happen online. This would include both consumer and government transactions, and attempt to establish a system where identity can be confirmed online in [...]

In the first half of December the Federal Trade Commission (FTC) and the Commerce Department’s Internet Policy Task Force (IPTF) each issued reports focused on privacy online. In both cases the reports are meant as the next step in a process of consultation and feedback between these agencies, the public, and relevant stakeholders. As the [...]

Coming from a call for papers and workshop held earlier this year, the Computer Science and Telecommunications Board of the National Academies has released Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy. The report focuses on the papers presented at a June workshop, and range from general technical [...]

Cybersecurity legislation is sort of popular in this Congress. Several bills have been introduced, but there are enough cybersecurity bills working through the process that it’s unclear whether or not anything will be passed by the time this Congress ends in the fall. The latest cybersecurity legislation was introduced yesterday by Senators Lieberman, Collins and [...]

Representative Rick Boucher, Chairman of the Subcommittee on Communications, Technology and the Internet released a discussion draft of an internet privacy bill. The bill, which was released with the Ranking Member of the subcommittee, Representative Cliff Stearns, addresses consumer information collected online by companies. A copy of the discussion draft is available via Rep. Boucher’s [...]

The Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) has announced prizes for research in cyberdeterrence. The CSTB announced prizes for papers submitted that address at least one of the Questions of Interest described in their call for papers. The deadline for papers is July 9. However, the CSTB committee running [...]

On December 9 the House passed two bills that could affect how consumers use peer-to-peer software and how their personal information is used. We wrote about these bills when they passed the House Energy and Commerce Committee back in September. This marks the first time the Data Accountability and Trust Act, H.R. 2221, has managed [...]

PASS ID, S. 1261, is a bill introduced in June as an attempt to break through the impasse over REAL ID. That law, passed as part of a budget bill in 2005, was intended to tighten the security of drivers’ licenses and state-issued identification cards to combat terrorism. The USACM Issue Brief on REAL ID [...]

In a markup session yesterday, the Senate Judiciary Committee approved two bills on the protection of consumer data. S 1490, the Personal Data Privacy and Security Act of 2009, takes a number of steps to increase the penalties for identity theft and to require data brokers take additional measures to protect the information they handle. [...]

The House Energy and Commerce Committee marked up two bills this morning addressing concerns over the use of consumers’ personal information and the potential exposure of that data through the use of peer-to-peer (P2P) programs. The Data Accountability and Trust Act (H.R. 2221) has gone through this committee in previous years, with almost the exact [...]

This morning the Research and Science Education Subcommittee of the House Science and Technology Committee met to mark up legislation that would amend the Cyber Security Research and Development Act. Much of the bill will simply extend authorized budget amounts for various research programs related to cybersecurity, but the bill will make some changes to [...]

While health care legislation is stalled, movement continues on increasing the use of both health information technology and electronic health records. The National Coordinator for Health IT is coordinating this effort. Created as part of the American Recovery and Reinvestment Act, two Health IT committees, one on Policy and one on Standards, have been meeting [...]

According to Wired.com’s Threat Level, the new California law requiring “organizations in California to report suspected incidents of intentional and unintentional unauthorized breaches of a patient’s personally identifiable health information to the California Department of Public Health” has prompted over 800 reports since the law went into effect January 1st of this year. Of the [...]

On June 10 the Research and Science Education subcommittee of the House Science and Technology Committee held a hearing on cybersecurity. This is the first of three planned hearings prompted by the Obama Administration’s recent cybersecurity review. On June 16 the Research and Science Education subcommittee will hold a hearing with the Technology and Innovation [...]

UPDATE 6/4 – USACM issued this press release outlining its comments on the cybersecurity review. USACM Chair Eugene Spafford noted that while “the President hit many of the right notes in his remarks” the report missed “any emphasis on funding, tools or support for better law enforcement” as well as any discussion of research. ORIGINAL [...]

The Information Security and Privacy Advisory Board (ISPAB) recently released a report to the Director of the Office of Management and Budget (OMB) on the need to update the nation’s privacy policies. Since the Privacy Act of 1974, there has been little or no government-wide guidance on privacy. Individual agencies have been responsible for the [...]

The Obama Administration recently finished a 60-day review of federal cybersecurity efforts. Melissa Hathaway, Acting White House Cyberspace Director, indicated in public remarks (scroll down for video) at the RSA computer security conference that the report is currently with the President for his review, and should be made public soon. As might be expected during [...]

On April 16 the Federal Trade Commission issued a proposed rule requiring entities to notify consumers in the event that the security of their electronic health information is breached. The FTC is seeking public comment between now and June 1st. You can read more about the comment process by reading the Federal Register Notice or [...]

Senator Rockefeller (D-West Virginia) introduced last week a bill that would increase the role of the federal government in cybersecurity. S. 773 (text not yet available on THOMAS), in its present form, would mark a significant change in the government’s role in cybersecurity. Provisions of the bill include having the National Institute of Standards and [...]

The new Secretary of Homeland Security, Janet Napolitano, indicated on Friday that there were many flaws and problems with the REAL ID law, which is intended to provide for more secure forms of identification. USACM submitted comments back in 2007 outlining our concerns with the program, which would not be as secure or reliable as [...]

The Bits blog at The New York Times recently ran an interview with Representative Rick Boucher (D-VA) the new Chair of the Subcommittee on Communications, Technology and the Internet of the House Energy and Commerce Committee. While telecommunications issues will be a big concern for Rep. Boucher, it appears that Internet privacy, a concern of [...]

Update – February 17 Reports indicate that there is no E-Verify participation requirement in the stimulus bill that should be signed later today. Orginial Post: February 4 The E-Verify program, a proposed national electronic employment verification system, continues to stagger toward full implementation. As we noted last fall, some federal contractors and subcontractors were supposed [...]

The majority staff of the House Homeland Security Committee hosted a workshop December 3 on “Constitutional Protections in Homeland Security.” A copy of the agenda is currently available on the Committee’s schedule page. The speakers covered a wide variety of homeland security related topics, including communications during natural disasters, data mining, information sharing, transportation, border [...]

Under a final rule published November 14, certain federal contractors and subcontractors will be required to use e-Verify, an electronic employment verification system, starting early next year. The regulation applies to certain contractors and subcontractors of the Defense Department, the National Aeronautics and Space Administration and the General Services Administration. It will take effect January [...]

According to the Government Accountability Office (GAO), many bulk and online public records contain Social Security Numbers (SSNs), exposing many people to an increased risk of identity theft. Responding to a request from Senator Charles Schumer, the GAO prepared a report addressing the following concerns: (1) to what extent, for what reasons, and to whom [...]

William Kovacic, Chairman of the Federal Trade Commission, appeared on C-SPAN’s The Communicators recently to discuss the Internet and privacy policy. The audio podcast is available online as well as a video clip – which appears to be Mac-unfriendly. It’s a wide-ranging discussion on many internet issues with one of the two agency heads (the [...]

Calling on the Executive and Legislative branches of the U.S. Government to “systematically” review every counterterrorism program that deals with personal data and establish new privacy protections, the National Academies recently released a new report examining counterterrorism efforts and privacy rights. In usual academies fashion, the report is a tome. The august body convened a [...]

An important part of crafting useful privacy policies is being informed by the best research available. To that end, organizations like The Privacy Place have focused on researching privacy questions and providing that information to the public. It’s a research center, and its work is sponsored in part by North Carolina State University and the [...]

While most attention is focused on the economic bailout proposals debated in Congress, other legislative activity is worth noting. Congress is supposed to break later this week for a campaign-related recess. It is unclear whether a post-election legislative session will be called. It was not following the 2006 elections, which resulted in a shift in [...]

A bill awaits Presidential signature that would strengthen prosecution and penalties for identity theft and other cybercrimes. Tucked into another bill (HR 5938) that extends Secret Service protection for former vice presidents, it should become law soon. This bill will institute federal civil and criminal penalties for various cybercrimes, including cyberextortion and conspiracy to commit [...]

The Washington Post reports today about the House Energy and Commerce Committee’s ongoing inquiry into the online tracking activity of various internet companies. The Post reports that some internet companies have been using targeted-advertising technology without the explicit consent of consumers. More than a third of the 33 companies that received letters have indicated they [...]

Part of the ongoing debates over electronic employment verification systems is that the current basic pilot, or E-Verify program, is set to expire later this year. While there is still some disagreement over how the program might be expanded, I am aware of no one in Congress advocating for the program to be discontinued. The [...]

Update July 27 The Washington Post ran an article on Friday describing a case of an internet service provider conducting deep packet inspection on customers in Kansas. Notice was affected through a change in the company’s privacy policy on its website. Subscribers were offered the opportunity to opt out of the test, but some lawmakers [...]

We wanted to point out two Issue Briefs available from USACM. The Issue Briefs are intended as short distillations of established USACM policy on various issues. More detailed explanations of USACM positions on these issues can be found in the relevant issue area of our website. The two new Issue Briefs are on Electronic Employment [...]

It appears that the Administration will take its first public step toward implementing the classified Cyber Initiative President Bush issued this January. According to the Washington Post, Rod Beckström, a Silicon Valley entrepreneur, has been chosen to run the new National Cyber Security Center. Beckström is most recognized for his involvement as co-founder and chairman [...]

Part of the immigration battles last summer was a proposal to expand what was then called the Basic Pilot program into a nationwide system of confirming a person’s employment eligibility online. For such an Electronic Employment Verification System (EEVS) to work effectively on a nationwide basis, it would have to confirm employment documents of approximately [...]

A policy goal – like privacy protections – that has been tried repeatedly over the last few years has been legislation or other efforts to encourage the adoption of health information technology. Previous attempts have stalled somewhere in the halls of Congress, and the most recent health legislation – HIPAA – the Health Insurance Portability [...]

Our next post in this series on Technology Policy in 2008 focuses on two connected issues – Identity Theft and Data Security. Data breaches continue, as a recent theft of a hard drive at Georgetown University demonstrates. According to PrivacyRights.org, since January 2005 there have been over 218 million records exposed. To date a corresponding [...]

The release last Friday of the final rule for REAL ID did not mark the end of the road for this issue, but the end of the beginning. In this second of our series of posts taking a high-level look at various technology policy issues, we focus on REAL ID, and how it stands a [...]

Update January 17 – USACM issued a press release on the final rules, which is available online. As mentioned in the previous post, the Department of Homeland Security (DHS) released its final rules for the REAL ID program on Friday, January 11. Last May USACM submitted comments on the proposed rules released in March 2007, [...]

At a press conference earlier today, the Department of Homeland Security released the final rule on REAL ID. The press release summarizes the proposed changes – at least those addressing the deadlines for implementation. The Department released preliminary rules on REAL ID in March of 2007, and in May USACM submitted lengthy comments objecting to [...]

Yesterday the House Ways and Means Committee introduced a bill to reduce identity theft through restricting the use of the Social Security Number (SSN). After a series of 16 hearings on the issue, including one where USACM-EC Member Annie Antón testified, the Committee cited the easy availability of the SSN and its common use as [...]

Senator Pryor (D-AR) introduced S 1625, the Counter Spy Act, earlier this month. The bill joins other legislation, which has already passed the House, that will try and reduce the harm of spyware. Senator Pryor is no stranger to the issue – he spoke at our April briefing on botnets and was recently appointed co-chair [...]

In the last two weeks, two different spyware bills have been approved by two different House committees. On Thursday, the House Energy and Commerce Committee approved HR 964, the Securely Protect Yourself Against Cyber Trespass Act, or the SPY Act. This committee has approved similar bills in the previous two Congresses, only to see the [...]

Last week the Senate Judiciary Committee sent S236, the Federal Agency Data Mining Reporting Act of 2007 to the Senate floor by a voice vote. The bill, which we posted about earlier this year, would require the federal government to report annually on the development and use of technologies that would mine data for patterns [...]

The Senate Judiciary Committee sent S236, the Federal Agency Data Mining Reporting Act of 2007 to the Senate floor by a voice vote. The bill, which we posted about earlier this year, would require the federal government to report annually on the development and use of technologies that would mine data for patterns of criminal [...]

The Department of Homeland Security released a Notice of Proposed Rulemaking about the REAL ID Act on March 1. The proposed REAL ID rules are available in the Federal Register, and subject to a 60 day comment period. The release about the notice is here: http://www.dhs.gov/xprevprot/laws/gc_1172765386179.shtm The actual notice (162 pages) can be found here: [...]