White House privacy adviser: We don't need more authority
238354
Blog: Congress is poised to transform a civil liberties oversight board into an independent agency with additional powers, but the current vice chairman isn't interested.
3606
The Bush administration on Wednesday said it had not misled the public about the role of White House lawyers in discussions about whether to destroy tapes of secret interrogations.
79867
Networld World's Scott Bradner has gotten a good look at the Personal Data Privacy and Security Act Of 2007. He's much, much less than impressed.
548024
In a recent interview, privacy advocate Marc Rotenberg said it isn't clear how government agencies or companies will use the personal data that they collect via things such as identity and shopping courtesy cards.
286180
Comment is free: Mark Lawson: Anyone stupid enough to do a computer's bidding is not losing civil liberties so much as their marbles.
767658
Colimnist Mike Elgan supports protecting privacy, but he also  sees many situations where he believes surveillance should be legalized, normalized or even required.
314274
By Anonymous  Without a computer-use policy in place, employees are apt to use the Internet to conduct personal affairs at work, thus hampering workplace productivity and exposing your organization to liability.
657046
The presidentÂs national security adviser sidestepped questions about how the administration would react to the release of the Iraq Study GroupÂs report.
166825
The site tweaks a privacy setting that had revealed personal information from private profiles after a Wired News inquiry, and explains its philosophy on users' privacy. Threat Level talks with chief privacy officer, Chris Kelly.
553251
Technology hasnât eliminated the desire for rules about who tells what, when and how.
351036
White House aides made extensive use of political e-mail accounts for official government business, despite rules requiring that they conduct such business through official communications channels, according to new evidence disclosed yesterday by congressional investigators.
231140
(InfoWorld) - Microsoft Chairman Bill Gates asked the U.S. Congress to pass a comprehensive privacy law this year, allowing consumers to control how their personal information is used. Gates repeated past Microsoft calls for a wide-ranging privacy law during a speech at advocacy group the Center for Democracy and Technology's (CDT) annual gala dinner Wednesday. A comprehensive privacy bill should allow consumers to control their personal data, should provide transparency about what their data is used for, and should notify them when their data has been compromised, Gates said. Gates said he believes the U.S. can achieve a balance between privacy and protecting the country against terrorists and other criminals. But the balance will not be an easy one to create, Gates said. While many U.S. residents would say they want as much privacy "as possible," law enforcement needs to be able to track criminals, Gates said. "These privacy issues are not as easy as you might think," he told the crowd. Gates hinted that some privacy protections can go so far that they become annoying to consumers. He talked about the Health Insurance Portability and Accountability Act (HIPAA), passed by Congress in 1996, which puts strict controls on the release of information. HIPAA too often asks patients to sign documents allowing the release of their medical records, he said. HIPAA is evidence "we don't always get it right the first time," Gates said. "All I know is I keep signing those forms." Another balance Congress needs to strike is between emerging technologies and privacy, said Senator Patrick Leahy, a Vermont Democrat and chairman of the Senate Judiciary Committee. Leahy also called on Congress to pass a privacy law. But a privacy law cannot restrict new technologies, Leahy said. "I don't want to stop the technologies, I want to protect our privacy," he during the gala dinner. "I think we can do both." The U.S. government spying on its residents is of particular concern, Leahy said. "I don't want to put a brake on technology, but on what my government can learn about me without letting me know," he said. Leahy and Gates both said they have great hopes for the future of the Internet. "The Internet is a great tool," Leahy said. "Let's keep it a free tool." The world is just at the beginning of the potential of the Internet coupled with personal computers, Gates added. Coming advances in storage, in bandwidth and in user-created content will make the Internet and even greater tool for democratic ideals, he said. "We're just at the very beginning," he said.
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
284052
Several members of a government board appointed to guard privacy and civil liberties during the war on terror say they're impressed with the protections built into the Bush administration's electronic eavesdropping program.
433751
The Bush administration has no clear strategy to protect the privacy of patients as it promotes the use of electronic medical records, investigators say.
581384
Representatives of wireless telephone carriers planning a telephone directory service told a US Senate committee Tuesday that legislation to protect their customers&#39; privacy isn&#39;t needed, because their plan already does.
574595
Anonymous data sets are an enormous boon for researchers, but the recent de-anonymization of Netflix customer data shows there are privacy risks as well. Commentary by Bruce Schneier.