InternetPolicy.net

Video surveillance for Shanghai's net cafes

Multiple news sources report that the Chinese government has installed video cameras in all 1,325 of Shanghai's Internet cafes, to monitor what people are seeing on their computer screens, and to verify the identity of customers, who may try to use their parent's identification card if they are under-age.

Israel eavesdropping in Holland?

Summarizing a more detailed report in Dutch from Netkwesties, Digital Media Europe's Joe Figueiredo says "People in the Netherlands believe that internet and telephone taps in the Netherlands are on the rise. Although actual numbers have not been revealed since 1998 due to state security considerations, figures published in that year showed that the Netherlands had made some 10,000 taps, overtaking even the USA. The Dutch have had internet-tapping legislation in place for several years, requiring ISPs to ensure that their networks can be easily tapped, and to make traffic data available to the police. Moreover, the Dutch also lead in satellite eavesdropping, with a sophisticated listening post established in Zoutkamp, equipped with at least six satellite dishes, and perhaps as many as 22... [Meanwhile] the Dutch lower house is seeking clarification on possible security breaches by Comverse, the Israeli supplier of tapping equipment installed in the Netherlands after the attacks on 11 September, 2001, and on the lack of oversight by the government and law-enforcement authorities. In late 2002, a Dutch radio programme revealed there was strong evidence that the Israeli secret service could deploy this equipment in the Netherlands to gain uncontrolled access to confidential tapping data collected by the Dutch police and intelligence services..."

Spyware on "up to 90%" of Internet-connected PCs?

Earthlink's Spy Audit claims that "up to 90 percent of all Internet-connected computers" may be infected with spyware. This is based on scans of over a million PCs by the Atlanta-based ISP during the period 1 January - 31 March 2004. They say they found an average of 27.8 "instances of spyware" per PC. Over 80 percent of these "instances" were "adware cookies...which store personal information (like your surfing habits, usernames and passwords, and areas of interest) and share the information with other Web sites. This sharing of information allows marketing firms to create a user profile based on your personal information and sell it to other firms. Adware cookies are installed and accessed without your knowledge or consent."

This coming Monday (19 April), the US Federal Trade Commission will host a day-long workshop on spyware at the FTC Conference Center (601 New Jersey Ave., NW Washington, DC 20001). "It is open to the public and there is no attendance fee." (Thanks to Slashdot for the pointers.)

Belgium to monitor all ADSL users

Expatica News says "The Computer Crime Unit of the federal Belgian police is to begin testing an Israeli system of so-called 'e-taps' on Belgacom high-speed internet connections on Monday, Belgian daily La Derniere Heure revealed. They then plan to install the system, which is capable of intercepting, reading and recording email messages, across all high-speed 'ADSL' lines in Belgium.

"'The legitimate fight against terrorism can in no way justify a practice which will see each citizen connected become liable to bugging,' said a statement published Friday by the Belgian committee of the League of Human Rights (LHR).... The LHR said it was 'scandalised' by the move and 'calls on the minister of the interior not to proceed with the tests of interception and recording and to definitively halt any introduction of this illegal system.' The eavesdropping 'constitutes a flagrant violation of the right to privacy as defined by both the European Convention on Human Rights and the Belgian constitution,' the LHR added.

"Belgian press reports Friday claimed that unlike phone taps, which are applied to a specific line, the snooping on high-speed internet lines would involve the filtering of all email traffic in order to intercept the targeted user. The system, called Nice, can also monitor all internet activity on an individual computer, including which websites he or she is visiting..."

EC presses 8 countries on e-privacy, spam

Leigh Phillips reports on Digital Media Europe that "The European Commission has taken the second step in infringement proceedings against eight member states for not adopting new privacy rules for digital networks and services. The eight members had failed to notify the Commission of measures transposing the directive on Privacy and Electronic Communications (e-privacy directive) into their national laws. The Directive governs areas like spam, e-mail and cookies.... Belgium, Germany, Greece, France, Luxembourg, the Netherlands, Portugal and Finland...now have two months in which to respond and could face action before the European Court of Justice if they fail to comply."

Gmail raises privacy concerns

BizReport.com relays an article by the Washington Post's Mike Musgrove: "Search engine Google Inc. announced yesterday that it is launching a free, Web-based e-mail service that will hold far more mail than rival services but also send users ads based on the content of their messages... Though Google's privacy policy states that 'no human reads your mail to target ads or other information without your consent,' and the company says the text analysis will be done by computer, the business model already has some concerned about privacy...

"Kevin Bankston, an attorney working as a fellow at the Electronic Frontier Foundation...worried that the information kept by Google for advertising purposes could wind up in a gray legal area not protected by the Electronic Communications Privacy Act...

"While Microsoft's Hotmail and Yahoo's Web-based mail service offer 2 or 4 megabytes of storage space, Google's 'Gmail' service will offer a gigabyte (1,000 megabytes)... Also, using the search engine technology that made the company famous, Google Gmail account holders will be able to search through the content of their archived e-mails. But some analysts worried about the security implications of users being able to keep so much of their life and correspondence in one place...

"Google did not announce when the service will be available to the public...."

Privacy tools dropped from US data-mining research

Today the CRM Knowledge Base relayed a report by Michael J. Sniffen for the Associated Press about the US Government "quietly pressing ahead with research into high-powered computer data-mining technology without the two most advanced privacy protections developed to police those terror-fighting tools. 'It's very inconsistent what they've done,'' said Teresa Lunt of the Palo Alto Research Center, head of one of the two government-funded privacy projects eliminated last fall. Even members of Congress like Sen. Ron Wyden, D-Ore., who led the fight to restrict the Pentagon terrorism research, remain uncertain about the nature of the research or the safeguards... 'We feel Congress is not getting enough information about who is undertaking this research and where it's headed and how they intend to protect the civil liberties of Americans,'' said Chris Fitzgerald, Wyden's spokesman.

"The privacy projects were small parts of the Pentagon's Terrorism Information Awareness research [led by retired Admiral John Poindexter]... Partly to appease critics, Poindexter also was developing two privacy tools that would have concealed names on records during the scans. Only if agents discovered concrete evidence of terrorist activities would they have been permitted to learn the identities of the people whose records aroused suspicion. One privacy project worked with Poindexter's Genisys program, which scanned government and commercial records for terrorist planning. The other was part of his Bio-ALIRT program, which scanned private health records for evidence of biological attacks. Late last year, Congress closed Poindexter's office in the Defense Advanced Research Projects Agency, or DARPA, in response to the uproar over its impact on privacy. But Congress allowed some Poindexter projects, including some data-mining research, to be transferred to intelligence agencies. Congress also left intact similar data-mining research begun in the fall of 2002 by the Advanced Research and Development Activity, or ARDA, a little-known office that works on behalf of US Intelligence. The research sponsored by ARDA, called Novel Intelligence from Massive Data, is so similar to some work done for Poindexter that Lunt offered to adapt her privacy protection software. ARDA and other agencies weren't interested because Congress had killed the original projects. 'When I went to talk to them, ARDA made clear they don't want to get into any area Congress doesn't want to fund,' Lunt said...."

Dilemma: wiretaps vs. Internet telephony

Stephen Labaton writes in today's New York Times about the conflict between "two cherished policies of the Bush administration" - deregulating major industries and expanding the government's ability to intercept phonecalls. As noted here earlier, the Justice Department and US intelligence agencies are upset with the Federal Communications Commission for treating Internet telephony as a minimally regulated "information service" rather than as "telecommunications" because that makes it harder to conduct wiretaps:

"In a series of unpublicized meetings and heated correspondence in recent weeks, officials from the Justice Department, the Federal Bureau of Investigation and the Drug Enforcement Administration have repeatedly complained about the commission's decision in 2002 to classify high-speed Internet cable services under a looser regulatory regime than the phone system... As a result of the commission's actions, said John G. Malcolm, a deputy assistant attorney general who has played a lead role for the Justice Department, some telecommunications carriers have taken the position in court proceedings that they do not need to make their networks available to federal agents for court-approved wiretapping. 'I am aware of instances in which law enforcement authorities have not been able to execute intercept orders because of this uncertainty,' Mr. Malcolm said in an interview last Friday...

"By contrast, some FCC officials and telephone industry executives say that if the commission buckles to the other agencies and forces the industry to take on a host of expensive obligations the development of promising new communications services may be stalled or squelched for years to come... 'What's most scary for industry and perhaps some people at the FCC is the notion that the architecture of the Internet will depend on the permission of the FBI,' said Stewart A. Baker, a former general counsel of the National Security Agency..."

US Govt's public key crypto projects reviewed

BeSpacific notes a US General Accounting Office report that was issued last month (GAO-04-157): Information Security: Status of Federal Public Key Infrastructure Activities at Major Departments and Agencies. The report finds many unresolved issues still hindering PKI implementation...

S Africa building email intercept centers

Lesley Stones, IT editor of Business Day in Johannesburg, said yesterday that the South African government's "communications department is inviting technology firms to submit proposals for the creation of interception centres designed to monitor e-mail and cellphone messages...

"Government gave itself the right to monitor private and corporate communications in the Regulation of Interception of Communications and the Provision of Communication Related Information Act of 2002... The centres' task will be to intercept communications to prevent or solve offences including terrorism, organised crime, or threats to the public safety, to promote national security or economic interests of the country...

"The centres would be able to intercept communications only after being granted a court order to do so, said Reinhardt Buys, the managing partner of technology law specialist Buys Attorney. They would then order internet service providers or cellphone companies to forward duplicate signals of suspect messages to an interception centre...

"However, a controversial part of the act is a demand that telecommunications companies and internet services providers must install and pay for the monitoring equipment themselves. That has raised concerns that the cost of the sophisticated devices will be passed on to customers, or could prove so expensive that smaller players are pushed out of business.

"Buys doubts that the centres will be kept busy. A court order authorising the interception of a communication will only be issued if there is compelling evidence that a crime is imminent. If law enforcement officers had that kind of evidence they would probably make an arrest rather than intercept electronic messages, he said." (via AllAfrica.com)