IP Address Is Personal Info, Says European Data Chief
262185
The EU's data protection commissioner says IP addresses should be regarded as personal information, a view, which, if adopted, would profoundly affect the privacy policies of companies like Google and Yahoo.
333215
A report by an EU panel released Thursday said the bank data transfer agency SWIFT broke European privacy laws by handing over personal data to U.S. authorities for use in anti-terror investigations.
364779
European council dilutes data proposals to taste European privacy wonks have become alarmed over the degeneration of policy talks on the protection of people who become the subject of police database cross-border pollinations.â¦
246258
(InfoWorld) - For months, German Interior Minister Wolfgang SchÃ¤uble has been lobbying intensively forÂ tough security measures to fight terrorismÂ and cybercrime. Now he's putting his words into action. Law enforcement officials in Germany and Austria are now among the first to have electronic access to each other's fingerprint databases, the German Federal Ministry of the Interior said Monday. Since 2006, the two countries have shared their DNA databases as one of several measures agreed by some European Union nations under the Treaty of PrÃ¼m in 2005. The treaty, which has meanwhile been signed by several E.U. member states, gives police and other security agencies in different countries unprecedentedÂ access to a range of individuals' personal data. During its E.U. presidency, Germany is trying to muster enough support to turn the Treaty of PrÃ¼m into E.U. law. Support for tough security measures has grown in Germany and other E.U. member states that worry about their national security being increasingly threatened by international terrorism, organized crime and, increasingly, cybercrime. Recently, the Baltic nation ofÂ Estonia suffered several weeks of DDOSÂ (distributed denial-of-service) attacks against government and private-sector Web sites. That DDOS attack sent a warning signal to governments across Europe. On Monday at an IT security conference hosted by the German Interior Ministry, SchÃ¤uble referred to information technology and communications infrastructures as "the nerve strands of society" and called on everyone -- governments, businesses and consumers -- to give IT security a top priority. Protecting critical infrastructure, including communication and energy grids, from cyberattacks is a key area of focus during the two-day conference. SchÃ¤uble is also determined to give the Federal Criminal Police Office (BKA) greater power to monitor terrorists and criminals online by allowing the agency to peek inside their computers. In an interview with the Berliner Zeitung published on Saturday, the minister said he aims to complete draft legislation over the next few weeks to allow the BKA to hack into the PCs of suspected criminals. This year Germany's High Court handed down a landmark decisionÂ banning police from installing spywareÂ on computers of suspected criminals without their knowledge. The High Court in Karlsruhe argued that searching computers is similar to searching homes, a practice in Germany that requires police to follow certain procedures, such as obtaining a search warrant and informing suspected offenders of a search. The judges also argued that hacking computers by the police is not permitted under Germany's strict phone-tapping laws and that legislation would be needed to enable covert surveillance. In the interview, SchÃ¤uble said he would amend Germany's constitutional law to allow online surveillance if the country's leading courts required such an amendment. In February, Germany passed a law allowing security officials to create the largest and most comprehensive pool of personal data ever amassed in the country. The databases of nearly 40 different agencies, including BKA and the Federal Intelligence Service (BND), are now linked to allow authorities to run searches on suspected individuals and retrieve information within minutes. Â
220980
Security over privacy 'becoming a mantra' Europe's data protection chief has warned Portuguese ministers that fundamental rights to freedom are being abused in the name of security. Portugal takes over the rotating EU Presidency on 1st July.â¦
27453
I was questioned today by a developer who was watching a particular IP address scan his site. The IP was 65.54.188.86 and is registered to Microsoft Corp.
342453
NEW YORK -- The Internet's key oversight agency is investigating suspicions that insider information is being used to snatch desired domain names before an individual or business can register them.
648691
Information commissioner lectures public bodies to take digital privacy 'far more seriously'
178885
Shouldn't be added as an afterthought Government needs to make privacy and data protection principles a core component of its IT specifications, according to the assistant information commissioner.â¦
137343
Homeland Security promises greater privacy protections for European travelers, contradicting a U.S. push for more data.
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
251253
(InfoWorld) - Executives from the financial data transfer company Swift and the president of the European Central Bank (ECB) faced tough questions in a European Parliament committee meeting Wednesday, about the illegal sharing of private data with U.S. authorities. ECB chief Jean-Claude Trichet denied that the bank should have stepped in to prevent the breach of European data protection laws, saying that the bank could only advise the Society for Worldwide Interbank Financial Telecommunication SCRL (Swift). "We have no judicial competence in the field of data protection," he said. Swift's Chief Financial Officer Francis van Bever explained that the company has two information storage facilities, one in the U.S. and the other in Holland. Each facility holds identical data: they serve as back-ups for each other in case one were to crash. "Each facility is subject to local laws," Van Bever said. "We were obliged to respond to the subpoena from the U.S. authorities." European law is unclear, he said, adding that after getting external legal advice in Belgium, Swift concluded that transferring the data to the U.S. authorities would be legal. "We didn't check with local data protection authorities because we thought what we were doing was legal," he said. U.S. agencies ordered Swift to share millions of pieces of information about people and companies from around the world in the wake of the terrorist attacks on Sept. 11, 2001. The information was deemed essential in tracing the financing of terrorism, and Swift complied with the order. However, European data protection laws forbid transfers of European citizens' personal data outside the E.U. if the country receiving the data has aÂ weaker data protection regimeÂ than Europe's. The U.S. is considered such a country under European laws. In June the New York Times revealed that Swift has been sharing the data with U.S. authorities for years, sparking investigations in Europe into how the European laws could so easily have been breached. Last week, Belgium's privacy commission concluded a two-month investigation, accusing Swift of breaking Belgian and Europe-wide data protection laws. However, it stopped short of proposing fines for the company, which it agreed was caught between conflicting legal requirements on each side of the Atlantic. Many European parliamentarians drew a parallel between the Swift case and the ongoing attempts to strike a data sharing agreement that would allow the U.S. authorities access to personal data about passengers flying to the U.S.. They were unimpressed by what more than one member of the European parliament referred to as "buck-passing" when it came to handing out responsibility for the data protection breach. Trichet tried to move the debate beyond casting blame by suggesting ways of avoiding similar problems in future. "This problem is ongoing," he said. "The system we have in place is imperfect. It is very important to clarify the situation and work out what to do about such data transfers across the Atlantic." He added that any agreement between the E.U. and the U.S. should then form the basis for a global solution, because the problem is worldwide. "We need a global legal framework for situations like this," Trichet said. Swift's van Bever agreed. "We would welcome such clarification," he said, adding that the double taxation treaty could be a role model. The treaty is signed by many countries around the world and is designed to prevent people being taxed twice on the same income by different tax authorities.
550193
(InfoWorld) - Financial data transfer company Swift can continue to pass details of European citizens' transactions to U.S. authorities provided the firm signs a formal get-out clause granting it immunity from European data protection laws, the European Commission said Thursday. The Society for Worldwide Interbank Financial Telecommunication SCRL (Swift) has been at the center of aÂ transatlantic dispute over data protectionÂ since being ordered to share millions of pieces of information about people and companies from around the world with U.S. agencies after the terrorist attacks on Sept. 11, 2001. The information was deemed essential in tracing the financing of terrorism and Swift complied with the order. However, European data protection laws forbid transfers of European citizens' personal data outside the European Union, if the country receiving the data has a weaker data protection regime than Europe's. The U.S. is considered such a country under European laws. In June 2006, The New York Times revealed that Swift had been sharing the data with U.S. authorities for years, sparkingÂ investigations in EuropeÂ into how the European laws could so easily have been breached. In an agreement reached between the European Commission, the German government, which currently holds the E.U.'s presidency, and the U.S. Treasury department, Swift can continue to share the information if it signs the safe harbor agreement, and as long as individuals are informed by their banks that the information will be passed over to U.S. authorities, the Commission said. If these conditions are met, then U.S. authorities are free to keep the data for up to five years, said European Commission spokesman Friso Roscam Abbing. The safe harbor agreement has been signed by many large multinationals including Microsoft. By signing it, companies agree to respect Europeans' private data once it leaves the E.U. "The E.U. will have now the necessary guarantees that the U.S. Treasury processes data it receives from Swift's mirror server in USA in a way which takes account of E.U. data protection principles," said Commission Vice President Franco Frattini, the commissioner responsible for justice, freedom and security. "I welcome the United States Treasury Department's unilateral representations and the opportunity the Treasury has given the European Union to have its views and concerns duly reflected in the representations," Frattini added. "As well as Swift joining the Safe Harbor and its compliance with the Safe Harbor privacy principles, we now look to Swift and to the financial institutions which use its services to ensure that they fully comply with their information obligations under European data protection law. We urge them to take all the necessary steps to ensure their quick compliance with European data protection law." Swift has promised to sign the safe harbor agreement in the coming days, while banks that use Swift to transfer funds have agreed to set up systems that will alert their customers of data transfers to the U.S. by Sept. 1, Roscam Abbing said. However, it remains unclear what happens if customers decide that they don't want their information shared, the Commission spokesman added. Â
257075
The European Union tackles the prospect of data-privacy breaches years ago; what's America bringing to the table now that Congress is taking the matter seriously? Patrick Lamphere analyzes where things are headed.
455724
The European Data Protection Supervisor says he expects the U.S. and the European Union to reach an agreement on how to share information about passengers flying across the Atlantic -- but not by the July deadline.
241449
EU Justice Commissioner Franco Frattini expressed confidence Thursday that the United States would correctly use personal data from the interbank transfer service SWIFT in anti-terror probes.
533205
With the EU crafting new laws governing how data collectors such as Google protect users' personal data, lawmakers there are clashing with US business leaders over how far that protection can and should extend.