The DHS Sends Out The Call For A National License Plate Database

from the more-'harmless'-metadata dept

In what reads like bad news all over, the DHS has just requested quotes for national automatic license plate reader (ALPR) database. There are currently several ALPRs in use and law enforcement agencies have been working hard to link systems up in order to better track vehicles as they move around the country. This has been hampered somewhat by multiple vendors, most of which aren't particularly interested in working with competitors. But even with multiple vendors, there's still a whole lot of data being stored -- a majority of which is entirely unrelated to criminal activity -- in easily-accessible databases.

License plate readers are used not only by police but also by private companies, which themselves make their data available to police with little or no oversight or privacy protections. One of these private databases, run by a company called Vigilant Solutions, holds over 800 million license plate location records and is used by over 2,200 law enforcement agencies, including the U.S. Department of Homeland Security.

A nationwide database, with records accessible by law enforcement and investigative agencies with few restrictions is obviously a concern. Tracking vehicles as they move around the country generates a ton of location data that can reveal a great deal about a person. It's always argued that what you do in public carries no expectation of privacy, but that statement is somewhat meaningless when you consider the number of plates ALPRs scan and store. Most states with ALPRs have gathered millions of records, which are held for as long as 5 years, with little in the way of minimization procedures. ELSAG, another ALPR vendor, brags in its own promotional Powerpoint presentation that it has collected 50 million records in New York City alone, without a single mention of minimization processes or the disposal of non-hit data.

For the government to actively call for a nationwide database is troubling. Since this is a solicitation for bids, there's no discussion on what, if anything, will be required from the winning contractor in terms of storage, minimization or disposal. Given the track records of the largest vendors, it's likely these issues will be of lesser concern than other aspects, like scanning speed and database accessibility.

The call for bids may have something to do with Vigilant's recent efforts, both on the PR front and in the courtroom.

First off, Vigilant (along with Digital Recognition Network) is suing the state of Utah for, believe it or not, violating its First Amendment rights.

It posits that a new Utah law which bans license plate collection by private companies, effectively put it out of business in the state. The law was intended to keep data from falling into police hands without oversight, and is among the first by surveillance technology firms to argue against privacy laws invoking the First Amendment.

The Texas company fired back, arguing that collecting license plate numbers is free speech. The lawsuit draws upon a recent major Supreme Court ruling, Citizens United v. FEC, which overturned a law curbing corporate and union donations to political campaigns. In effect, the Court ruled that money is speech.

“The Texas company says it’s not a police agency – law enforcement already is exempt from the ban under Utah’s new law — nor can it access in bulk federally protected driver data that personally identifies the letters and numbers it collects from license plates in public,” the Associated Press reported Thursday. “The company said it only wants to find cars that have been stolen or repossessed, not to cull large swaths of data and incriminate people from their travel habits.”

DRN's press release goes into a little more detail on this rationale.

“Taking and distributing a photograph is an act that is fully protected by the first Amendment,” said DRN / Vigilant Outside Counsel Michael Carvin. “The state of Utah cannot claim that photographing a license plate violates privacy. License plates are public by nature and contain no sensitive or private information. Any citizen of Utah can walk outside and photograph anything they please, including a license plate.”

This is an interesting approach. It's a bit disingenuous to compare scanning license plates at a rate of hundreds per hour to someone walking around taking pictures of license plates (not the least of which is the fact that a private photographer most likely wouldn't have a searchable database), but underneath it all, the point remains: these are photographs of publicly-available items. It will be tough for a court to find a "bright line" that separates these two without weakening First Amendment protection. Then again, as the ACLU has noted, it's not really the photography that's a problem, it's the handling of the non-hit data, something that won't be addressed in this suit. That's Utah's problem and if it loses this case, then it needs to push for heavy restrictions on how the data is accessed and used, as well as rules on data disposal.

Using an unpopular decision (Citizens United) to argue that losing income equals losing free speech rights is a bit more troublesome. Of course, those opposed to that decision may welcome a court battle on the issue, as it may cast further doubt on the validity of that ruling. But does a company deserve to make money, much in the way it might deserve First Amendment protections? That's another grey area with no bright line and this two-pronged approach may allow Vigilant and DRN to set up their ALPR systems despite the state of Utah's opposition. (Of course, Utah would be free to use another vendor, but any decision in the ALPR companies' favor will help them attack similar laws elsewhere.)

It would appear that Vigilant is trying to knock down state laws that might curtail its national aspirations. Appearing on the same day as this lawsuit announcement was a Vigilant press release touting its ALPR's crime fighting abilities.

Vigilant Solutions announces today that the Loganville Police Department in Georgia attributes recent and significant arrests to their use of license plate recognition (LPR) technology from Vigilant Solutions.

Assistant Chief M.D. Lowry comments, “On January 7, one of our officers received an alert from his license plate reader (LPR) system on a vehicle which was associated with an active arrest warrant out of Texas. Our officer initiated a traffic stop per policy and identified the driver. Following protocol, the officer used other systems to validate the hit and was able to confirm the driver was wanted out of Del Rio, Texas for Indecent Acts with a Child, 2nd Degree. The suspect was taken into custody without incident and transported to the Walton County Jail to await extradition…"

We have only had our single unit for only a few months, but it is already proving its value by helping us to remove these threats from our community. I can tell you that the capture of a child molester from nearly 1,200 miles away was more than worth the cost of the LPR unit. If we never make another case with it, it was worth the cost.”

Two immediate questions arise. The first is: if you never make another case with it, what's the point of gathering all that data? Does the arrest of one child molester make the routine harvesting of thousands of plates of non-child molesters "worth it?"

Second: pointing out the ends as justification for the means is a rhetorical dodge. There are any number of things law enforcement could do to bump arrest numbers -- like house-to-house searches and eliminating the probable cause requirement for warrants -- but neither takes into consideration the constitutional rights of those on the receiving end of these actions. Law enforcement is supposed to work within these limitations, rather than see how hard they can push back against them.

The call for bids on a national ALPR database takes a localized problem and makes it worse. The government (both on local and national levels) has shown repeatedly that it prefers to implement technology before considering the privacy implications. Post facto "repairs" generally only come into play once widespread misuse has already been reported. This is a chilling, but not unexpected, development. If it can be construed as "public," then it's the government's for the taking, apparently.

Filed Under: alpr, database, dhs, license plate

UK Police And Companies Will Have Access To Database Of All England's Medical Records

from the privacy-disaster-waiting-to-happen dept

The UK government is currently building a database called care.data that will contain all of England's medical records. It's being promoted as providing valuable information for healthcare management and medical researchers that will lead to improved treatment.

Given the extremely sensitive nature of the material that will be stored, you might have expected this to be opt-in, but instead the UK government has chosen to make it opt-out. Not only that, but the relatively sparse information about what was happening was sent in the form of a generic, unaddressed letter that differs little from the dozens of junk mail pieces received by most households each week, and failed to include any easy-to-use opt-out form.

This has fuelled suspicions that the UK government is making it hard to opt out in order to keep the numbers enrolled in the database as high as possible. More recently, good reasons why people might want to avoid the scheme have emerged. For example, it was revealed that as well as being provided to research scientists, the database could also be bought by companies:

Drug and insurance companies will from later this year be able to buy information on patients -- including mental health conditions and diseases such as cancer, as well as smoking and drinking habits -- once a single English database of medical data has been created.

Now we learn that the UK police will also have access:

The database that will store all of England's health records has a series of "backdoors" that will allow police and government bodies to access people's medical data.

As the UK MP David Davis told the Guardian:

"The idea that police will be able to request information from a central database without a warrant totally undermines a long-held belief in the confidentiality of the doctor-patient relationship," he said.

That means that as well as the risk of a privacy disaster of unprecedented proportions if the consolidated health data is lost or stolen as a result of being passed to third parties (as has already happened with a similar but smaller database), patients may be less likely to confide in their doctors knowing that details will end up in a database sold to companies and freely available to the police. Nice work, Mr Cameron.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: companies, database, healthcare data, medical records, nhs, police, privacy, uk

MN State Rep Joins 17 Others In Suing State For Illegally Accessing Drivers License Data

from the sorry-about-the-violations,-here's-someone-else's-money dept

You know you've gone too far in abusing access to the public's data when you've got a local politician doing something more than yelling about it on the campaign trail. Earlier this year, a report by state auditors discovered that more than half of Minnesota's 11,000 law enforcement agents had misused the Driver and Vehicle Services (DVS) database.

This discovery led to the filing of a few lawsuits, but as further details have emerged, bigger plaintiffs are filing bigger lawsuits.

Steve Drazkowski, a Republican Minnesota state representative, becomes the latest politician in the state to sue various local and state agencies over public employees accessing his and his family’s driver’s license data as part of a campaign of political retaliation. He is suing along with 17 other state residents who say their data was accessed more than 600 times since 2003. Drazkowksi says the actions go back to when he first ran for state office, and was motivated by his fiscally conservative stance toward unions.

It's probably not a good idea for public servants to further irritate a state rep who already takes a very dim view towards unions and the public sector in general. Erick Kaardal, the attorney representing the group, says the data accesses were clearly politically-motivated.

For example, [Kaardal] said, the plaintiffs' data was accessed after announcements for political candidacy, on the day letters critical of the government were printed in the newspaper and on dates immediately following county board meetings where group members challenged public officials.

"They even went after the private data of my wife and my daughter — why?" State Rep. Steve Drazkowski, R-Mazeppa, said in the statement.

If these public servants were expecting to dig up a little dirt or intimidate someone, it clearly backfired. If that was the intent, it seems like it would have been cheaper to pay a per diem to a private investigator and send out someone from New Jersey waste management to take out a few kneecaps.

Federal law allows for a minimum of $2,500 for each violation of the Driver's Privacy Protection Act, which makes it illegal to get an individual's private data without a legitimate purpose. Kaardal said damages could exceed hundreds of thousands of dollars.

That's 600 alleged violations at $2.5k each in this lawsuit alone. Across the state, 530 additional claims have been filed against 160 municipalities. And Tom Grundhoefer, general counsel of the League of Minnesota Cities, says the number is "going up daily."

Also named in many of the lawsuits is the Department of Public Safety itself, which is accused of allowing "lax access" and failing to crack down on the "widespread abuse" uncovered by the state's audit.

Ultimately, though, this will all land on the public, not because they accessed the records illegally, but because collecting settlements from state agencies means handing out tax dollars. Public servants are supposed to be good stewards of the money they've been entrusted with. Violating citizens' privacy and then asking them to pay for these violations is screwing them twice.

Filed Under: access, database, drives license, minnesota, privacy

Perhaps The NSA Should Figure Out How To Keep Its Own Stuff Secret Before Building A Giant Database

from the just-saying... dept

Apparently, the brilliant minds at the NSA are completely bewildered as to how Ed Snowden had access to everything he had access to. They don't think it's possible.

Among the questions is how a contract employee at a distant NSA satellite office was able to obtain a copy of an order from the Foreign Intelligence Surveillance Court, a highly classified document that would presumably be sealed from most employees and of little use to someone in his position.

A former senior NSA official said that the number of agency officials with access to such court orders is “maybe 30 or maybe 40. Not large numbers.”

And, according to other reports, Snowden delivered much, much more to reporters:

Mr. Snowden has now turned over archives of “thousands” of documents, according to Mr. Greenwald, and “dozens” are newsworthy.

In other words, more leaks are to come. But, considering that people are already scrambling to see how one pretty junior IT guy could have access to such things, it's making people wonder just how screwed up the NSA is if information could leak out this way -- and conversely, why should we trust them with our data?

Edward Snowden sounds like a thoughtful, patriotic young man, and I’m sure glad he blew the whistle on the NSA’s surveillance programs. But the more I learned about him this afternoon, the angrier I became. Wait, him? The NSA trusted its most sensitive documents to this guy? And now, after it has just proven itself so inept at handling its own information, the agency still wants us to believe that it can securely hold on to all of our data? Oy vey!

Or, as Farhad Manjoo notes later in that same article:

The scandal isn’t just that the government is spying on us. It’s also that it’s giving guys like Snowden keys to the spying program. It suggests the worst combination of overreach and amateurishness, of power leveraged by incompetence. The Keystone Cops are listening to us all.

And, on top of that, people are pointing out that if Snowden could walk out with that much supposedly secret information, you have to wonder who else has done so as well, perhaps with much more nefarious intent, such as selling the information to a foreign power or group. Conor Friedersdorf points out that having the NSA collect so much data makes it a key target for the Chinese:

Even assuming the U.S. government never abuses this data -- and there is no reason to assume that! -- why isn't the burgeoning trove more dangerous to keep than it is to foreswear? Can anyone persuasively argue that it's virtually impossible for a foreign power to ever gain access to it? Can anyone persuasively argue that if they did gain access to years of private phone records, email, private files, and other data on millions of Americans, it wouldn't be hugely damaging?

Think of all the things the ruling class never thought we'd find out about the War on Terrorism that we now know. Why isn't the creation of this data trove just the latest shortsighted action by national security officials who constantly overestimate how much of what they do can be kept secret? Suggested rule of thumb: Don't create a dataset of choice that you can't bear to have breached.

And, yet, that's exactly what we've done. If Snowden had access, then it seems only reasonable to assume that he wasn't the only one. Meaning that plenty of others also had access to the same information, and there's a decent chance that it's already leaked to others. The NSA is supposed to be the best of the best, but they don't even seem to know how to keep their secrets secret.

Filed Under: database, ed snowden, it, leaks, nsa, nsa surveillance, risks

Classic Function Creep As EU Police May Gain Access To Asylum Seekers Fingerprint Database

from the exceptionally-common-situations dept

As Techdirt readers well know, one of the problems with measures brought in for "exceptional situations" -- be it fighting terrorism or tackling child pornography -- is that once in place, they have a habit of being applied more generally. A case in point is the blocking of Newzbin2 by BT in the UK. That was possible because BT had already installed its "Cleanfeed" system to block child pornography: once in place, this "specialized" censorship system could easily be deployed to block quite different sites.

Another, more recent, case from the EU involves Eurodac, a database with fingerprint information provided by asylum seekers there. Here's the original justification for storing them:

The database was originally established in 2000 so EU nations could check whether an asylum seeker had previously applied for asylum in another European country or was receiving social benefits from another EU country. According to EU law, asylum seekers can apply for asylum only in the EU nation where they first entered the bloc.

But the politicians have noticed that this biometric data could be handy in quite different circumstances:

such a rich source of existing data has recently sparked the interest of other parties. If the EU Commission's requests are followed, Eurodac fingerprint data will be accessible to police officers during investigations. The commission's proposal envisions national law enforcement agencies and Europe's supranational criminal police commission, Interpol, being able to access the database.

Of course, allowing the police to check people's fingerprints in this way would have serious implications for privacy. Indeed, Peter Hustinx, head of the European Data Protection Supervisor, has already weighed in on the subject:

"Just because data is being collected doesn't mean that it should be used for another purpose, especially since that can have a hugely negative effect on the lives of individuals," said Peter Hustinx, head of the European Data Protection Supervisor.

And that really is the nub of the issue: people who agree to provide highly-personal data for one purpose, may then find it being used for another, without being asked. And if the European Commission gets its way, even more data will be shared:

"The Commission would generally like to widen its collection of data and make available any information regarding criminal prosecutions," [Green Party MEP] Keller said. "One example is the so-called 'Smart Borders' package, which actually wasn't proposed this round but has been in the pipeline for a long time. The idea there is that in the future anyone from non-EU countries that would like to travel into the EU will be recorded electronically, which also includes fingerprints."

As more and more biometric data is collected around the world, this kind of function creep is likely to become increasingly common.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: asylum, database, eu, fingerprints, function creep, law enforcement, privacy

Obama Administration Quietly Allowed National Counterterrorism Center To Keep Database Of Info On Innocent Americans

from the total-information-privacy-breach dept

The arguments are still ongoing concerning whether or not Congress will reauthorize the FISA Amendments Act, which has enabled -- via a secret interpretation of the law, that even many members of Congress are not told about -- law enforcement to collect huge chunks of private info on Americans with no oversight or warrants. However, in a move that should raise significant concerns about allowing such widespread trolling of private info, a report in the Wall Street Journal by Julia Angwin uncovered that the Obama administration quietly changed the rules back in March concerning the National Counterterrorism Center -- allowing it to retain a giant database of information on innocent Americans. This was done over the objections of many in the administration, including the "Chief Privacy Officer" for the Department of Homeland Security.

The National Counterterrorism Center (NCTC) is where all intelligence agencies were told to send their leads, after it was determined that there was an intelligence failure that allowed the so-called underwear bomber, Umar Farouk Abdulmutallab, to get on a plane a few years ago. Then came some interagency squabbling over information:

Unfortunately, NCTC didn't have the resources to "exhaustively" pursue the torrent of leads it began receiving. So it fell behind. Late last year, after Homeland Security had given NCTC a database on condition that it purge the names of all innocent persons within 30 days, things came to a head. Homeland Security eventually revoked NCTC's access to the data and NCTC decided it needed to operate under different rules. In particular, it wanted unlimited access to all government agency information for as long as it needed it, including both suspects and non-suspects alike. In March, after discussion at the White House, Eric Holder granted their request.

In a separate blog post, Angwin breaks down the specific rule changes from the 2008 document to the 2012 document. They detail just how a system that was initially limited to protect privacy has now turned into the exact opposite of that. Among the rule changes: it used to require a focus on terrorism information. No longer. And then there are the following two changes:

Dropping the requirement to remove innocent U.S. person information. The 2008 guidelines required NCTC to remove US person information that is “not reasonably believed to be terrorism information.” In 2012, the guidelines were updated to allow NCTC to keep U.S. person information for “up to five years” and to “continually assess” the information to determine whether it constitutes terrorism information.

Adding the ability to do “pattern-based queries” of entire datasets. The 2008 guidelines explicitly prohibit analysts from conducting “pattern-based” queries that are not based on known terrorism datapoints. The 2012 guidelines explicitly allow pattern-based queries that are not based on known terrorism data points. Pattern-based queries are still prohibited for databases that NCTC has not copied in its entirety.

Or, as the original article noted:

Now, NCTC can copy entire government databases—flight records, casino-employee lists, the names of Americans hosting foreign-exchange students and many others. The agency has new authority to keep data about innocent U.S. citizens for up to five years, and to analyze it for suspicious patterns of behavior. Previously, both were prohibited.

This all comes out almost exactly a decade after it was revealed that the feds were planning a "Total Information Awareness" program to troll through all of its databases to try to hunt down evidence of terrorism at work. That resulted in widespread public backlash and an eventual backing down from the program. This time around, since the whole thing was debated outside of the public eye (and they didn't given it an Orwellian name -- or an equally creepy logo), apparently it's just fine.

But, if you actually believe in things like basic civil liberties, the 4th Amendment and a right to privacy, this is all downright scary. It's the type of stuff that we're told over and over again the US government isn't supposed to do. And then it goes and does it anyway.

Filed Under: database, homeland security, national counterterrorism center, nctc, obama administration, privacy, total information awareness

Law Enforcement Looking To Create A Searchable Database Of Everywhere Your Vehicle Has Been

from the oh-wow...-a-Google-with-even-LESS-privacy dept

Back in August, Mike wrote about some questionable sharing of license plate information between the US Border Patrol and various insurance companies. While the stated aim of tracking stolen vehicles might seem to make this sharing justified, the fact that this is going on with no oversight or accountability is cause for alarm.

Of course, law enforcement has long had big plans for license plate readers (LPRs). The ACLU has come across a recording of a 2010 National Institute of Justice conference in which one of the speakers expresses an interest in building LPR data into a "Google" of license plate locations.

Dale Stockton, Program Manager of the “Road Runner” project at the Automated Regional Justice Information System in San Diego spoke on a panel on license readers at the 2010 conference and explained to police and prosecutors in attendance how best to share license plate data. Mind you, he was talking about the location information of people never accused of any crime.

Stockton knows this would never fly if attempted directly. He states as much in the transcript:

We're probably not going to have any centralized national giant bucket of license plate reader data. It probably wouldn't stand the court of public opinion, and it's probably something that, given where we are in the rollout cycle, wouldn't easily be done, but we can develop regional sharing capability...

But the "court of public opinion" can be routed around, according to Stockton. Despite frankly stating that the public would find a "Google of license plates" odious, he intends to do just that, through a series of back doors.

And so doing, you get those set up and then begin to share between those regions, and as you begin to look beyond your region, utilize a trusted broker like Nlets...

Every law enforcement agency has a connection to Nlets. Nlets would serve not as a storage unit but as a pointer system, something akin to a Google, so that when you check a plate, Nlets would point you in the direction of where that plate can be found, and the result of that would be a query in one state by an investigator could give an indication of plates of interest in other states, and then that information can be pulled back.

If Stockton has his way, a decentralized search system for license plates, routed through a third-party's software, will perform exactly the way he wants it to. Somehow he feels that a distributed system is OK while a centralized system isn't. Or rather, he feels that both systems are OK, but the public will only put up with the illusion that law enforcement isn't running a Google-esque system of harvested plate data.

Is the fear of a system like this overblown? Every law enforcement official at the conference runs down several anecdotes about how the plate reading system has aided them in investigating various crimes. But should law enforcement have access to nationwide plate data, much of which pertains to citizens who have never been accused of a crime, much less committed one? Stockton tries to justify the LPR system by comparing it to officers running plates in person.

One of the questions about license plate readers is this kind of hocus pocus, "you are invading my privacy; it's super intrusive." And I come from the opposite end of the spectrum. I truly believe that this technology is only doing what license plate readers have already — I'm sorry — what officers have already been doing in the field for many, many years.

The courts have indicated to us that officers can look at a plate and run it. So let's just go down quickly here through the two sides, an officer doing it and the license plate reader doing it. Officers can run plates anytime they want. The courts have held that's why we put the state plate on there, so an officer can check and make sure it's current and it's not wanted. Well, the license plate reader is doing the exact same thing. It's looking at it; it's checking that plate to see if it's wanted. The officer can pick and choose among the vehicles that he or she looks at.

The biggest difference here is the "always on" aspect and the fact that everyone is tracked. "Reasonable suspicion" and the like are taken completely off the table and replaced with an indiscriminate system that harvests data. It's a handy way to peel back another layer of privacy, as Kade Crockford of the ACLU states:

We've been making a lot of noise about location tracking of late. License plate readers rank high among the technologies that are threatening our privacy with respect to our travel patterns. Where we go says a lot about who we are, and law enforcement agencies nationwide are increasingly obtaining detailed information about where we go without any judicial oversight or reason to believe we are up to no good. Stockton says we have nothing to worry about with respect to license plate reader data and privacy, that that's all "hocus pocus." But he's wrong.

We must ensure license plate readers do not become license plate trackers.

As Crockford points out, the Department of Justice has already stated that Americans have "no privacy interest" when it comes to cellphone location information. The DOJ's rationale could easily stretch to fit this scenario. But what's "good" for the American public is rarely viewed as acceptable for those writing the guidelines or using the technology. For all the talk about "nothing to hide," officials are very touchy when it comes to making their information accessible.

Data from license plate readers in Minnesota was obtained by a St. Paul car dealer using open-records laws, and used to repossess at least one car, according to a recent article in the Minneapolis Star Tribune. The article included this amusing tidbit:

"When the Star Tribune published data tracking Mayor R.T. Rybak's city-owned car over the past year, the mayor asked police Chief Tim Dolan to make a recommendation for a new policy about data retention."

So, the question that needs to be asked of every politician and law enforcement member who feels this system will only be used for catching "bad guys" is whether or not they'd mind having their location tracked via license plate readers. Stockton's pushing for something he knows the public won't stand for and is using successful investigations as the ends to justify the privacy-violating means.

Filed Under: 4th amendment, database, law enforcement, license plates, privacy

How UK Police Attempted To Misuse Official Databases To Smear Disaster Victims

from the if-they-can,-they-will dept

A recent scandal in the UK concerned the country's worst sporting disaster, when 96 football/soccer fans were crushed to death at a stadium in Hillsborough in 1989. Prime Minister David Cameron issued an official apology to the families of the victims for the fact that the safety measures at the ground were known to be inadequate, and that police and emergency services had tried to deflect the blame for the disaster onto fans.

One way the police did this was by falsifying statements made to them after the disaster, to remove negative comments about how they had handled the situation. But another way involved trying to suggest the deaths were caused in part by the drunken behavior of fans. One attempt to bolster this view apparently involved the use of the UK's main Police National Computer system. Here's what the Report of the Hillsborough Independent Panel (pdf) wrote about new evidence that had come to light:

2.5.112 The document indicates that a Police National Computer (PNC) check was conducted on all who died at Hillsborough for whom a blood alcohol reading above zero was recorded. It includes a handwritten list of the names, dates of birth, blood alcohol readings and home addresses of 51 of the deceased and provides screen-prints apparently drawn from the PNC. A summary of the results appears on the front page, establishing the number 'with cons' (convictions).

The idea was clearly to point to previous convictions as evidence that many of those who died were in some way responsible for the deaths of themselves and others because of drunkenness. As TJ McIntyre emphasizes in a blog post on this revelation:

This illustrates an important point that privacy campaigners have been making for a long time: centralised databases of this type can and will be abused, and the power to trawl databases for information on individuals -- in effect, to manufacture a case against them -- is a dangerous one. It's not hard to imagine how data retention records might be abused in a similar way in future.

Although the UK government's proposed "Snooper's Charter" foresees the creation of distributed databases of information about every citizen's online activities, it will be possible to carry out "filters" -- searches -- across them, unifying them into a single, virtual centralized database. As McIntyre notes, it's easy to imagine these hugely-detailed records being trawled for information and then used by the police to cover up their own blunders in the future, or to support a flimsy case against someone, in exactly the same way that those involved in the Hillsborough disaster tried to do with the existing PNC database. The latest revelations of database misuse are another compelling reason not to bring in the intrusive and ineffective approach that lies at the heart of the UK government's plans.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: abuse, database, police, privacy, uk

US Offender Monitoring System Goes Offline Because Someone Didn't Realize They Ran Out Of Storage

from the are-you-serious? dept

Apparently the system that tracks sex offenders and paroled prisoners and other convicts via electronic tags was totally unreachable for about 12 hours last week, because no one at the company who ran the system, BI, apparently noticed that they had run out of space on their servers. "In retrospect, we should have been able to catch this," claimed a spokesperson for the company. You think? While the data as to their whereabouts was still collected, and the people being tracked were unaware of the lack of monitoring while it was happening, it still makes you wonder why so many governments trust such a system to a company that can't even monitor when they're running out of data storage space.

Filed Under: database, offenders, tracking
Companies: bi

Why Isn't There A Central Database Of E-Voting Problems?

from the seems-like-a-no-brainer dept

For many years, we've been reporting on stories of e-voting malfunctions, mainly from Diebold/Premier, ES&S and Sequoia. For a sampling of such stories click on any of the following links: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25. And that's just the first 25 I found (there are lots more), and only cover stories that I actually covered. I'm sure plenty more glitch-infused elections have happened. Given all these glitches and errors, and a seeming lack of followthrough to make sure they don't happen again, a group is asking Congress to authorize a public national database of e-voting election problems.

The really scary part is that the researchers who wrote the report note that many of the problems are repeats -- a problem happens in one location, but another voting district uses the same machines configured in the same problematic way in another election, totally unaware of the problems it will cause. It's still amazing that after nearly a decade of examples of problems with e-voting, just how little has been done to fix these machines.

Filed Under: database, e-voting, problems
Companies: diebold, es&s, premier, sequoia