Take My Privacy, Please!

By TED KOPPEL Published: June 13, 2005 – New York Times

The Patriot Act – brilliant! Its critics would have preferred a less stirring title, perhaps something along the lines of the Enhanced Snooping, Library and Hospital Database Seizure Act. But then who, even right after 9/11, would have voted for that?

Precisely. He who names it and frames it, claims it. The Patriot Act, however, may turn out to be among the lesser threats to our individual and collective privacy.

There is no end to what we will endure, support, pay for and promote if only it makes our lives easier, promises to save us money, appears to enhance our security and comes to us in a warm, cuddly and altogether nonthreatening package. To wit: OnStar, the subscription vehicle tracking and assistance system. Part of its mission statement, as found on the OnStar Web site, is the creation of “safety, security and peace of mind for drivers and passengers with thoughtful wireless services that are always there, always ready.” You’ve surely seen or heard their commercials, one of which goes like this:

Announcer The following is an OnStar conversation. (Ring)
OnStar OnStar emergency, this is Dwight.
Driver (crying) Yes, yes??!
OnStar Are there any injuries, ma’am?
Driver My leg hurts, my arm hurts.
OnStar O.K. I do understand. I will be contacting emergency services.
Announcer If your airbags deploy, OnStar receives a signal and calls to check on you.
(Ring)
Emergency Services Police.
OnStar This is Dwight with OnStar. I’d like to report a vehicle crash with airbag deployment on West 106th Street.
Emergency Services We’ll send police and E.M.S. out there.
Driver (crying) I’m so scared!
OnStar O.K., I’m here with you, ma’am; you needn’t be scared.

Well, maybe just a little scared. Tell us again how Dwight knows just where the accident took place. Oh, right! It’s those thoughtful wireless services that are always there. Always, as in any time a driver gets into an OnStar-equipped vehicle. OnStar insists that it would disclose the whereabouts of a subscriber’s vehicle only after being presented with a criminal court order or after the vehicle has been reported stolen. That’s certainly a relief. I wouldn’t want to think that anyone but Dwight knows where I am whenever I’m traveling in my car.

Of course, E-ZPass and most other toll-collecting systems already know whenever a customer passes through one of their scanners. That’s because of radio frequency identification technology. In return for the convenience of zipping through toll booths, you need to have in your car a wireless device. This tag contains information about your account, permitting E-ZPass to deduct the necessary toll – and to note when your car whisked through that particular toll booth. They wouldn’t share that information with anyone, either; that is, unless they had to.

The State Department plans to use radio frequency identification technology in all new American passports by the end of 2005. The department wants to be sure that we all move through immigration quickly and efficiently when we return from overseas. Privacy advocates have suggested that hackers could tap into the information stored on these tags, or that terrorists might be able to use them to pinpoint American tourists in a crowd. The State Department assures us that both concerns are unfounded, and that it will allow privacy advocates to review test results this summer.

Radio frequency identification technology has been used for about 15 years now to reunite lost pets with their owners. Applied Digital Solutions, for example, manufactures the VeriChip, a tiny, implantable device that holds a small amount of data. Animal shelters can scan the chip for the name and phone number of the lost pet’s owner. The product is now referred to as the HomeAgain Microchip Identification System.

Useful? Sure. Indeed, it’s not much of a leap to suggest that one day, the VeriChip might be routinely implanted under the skin of, let’s say, an Alzheimer’s patient. The Food and Drug Administration approved the VeriChip for use in people last October. An Applied Digital Solutions spokesman estimates that about 1,000 people have already had a VeriChip implanted, usually in the right triceps. At the moment, it doesn’t carry much information, just an identification number that health care providers can use to tap into a patient’s medical history. A Barcelona nightclub also uses it to admit customers with a qualifying code to enter a V.I.P. room where drinks are automatically put on their bill. Possible variations on the theme are staggering.

And how about all the information collected by popular devices like TiVo, the digital video recorder that enables you to watch and store an entire season’s worth of favorite programs at your own convenience? It also lets you electronically mark the programs you favor, allowing TiVo to suggest similar programs for your viewing pleasure. In February, TiVo announced the most frequently played and replayed commercial moment during the Super Bowl (it involves a wardrobe malfunction, but believe me, you don’t want to know), drawing on aggregated data from a sample of 10,000 anonymous TiVo households. No one is suggesting that TiVo tracks what each subscriber records and replays. But could they, if they needed to? That’s unclear, although TiVo does have a privacy policy. “Your privacy,” it says in part, “is very important to us. Due to factors beyond our control, however, we cannot fully ensure that your user information will not be disclosed to third parties.”

Unexpected and unfortunate things happen, of course, even to the most reputable and best-run organizations. Only last February, the Bank of America Corporation notified federal investigators that it had lost computer backup tapes containing personal information about 1.2 million federal government employees, including some senators. In April, LexisNexis unintentionally gave outsiders access to the personal files (addresses, Social Security numbers, drivers license information) of as many as 310,000 people. In May, Time Warner revealed that an outside storage company had misplaced data stored on computer backup tapes on 600,000 current and former employees. That same month, United Parcel Service picked up a box of computer tapes in New Jersey from CitiFinancial, the consumer finance subsidiary of Citigroup, that contained the names, addresses, Social Security numbers, account numbers, payment histories and other details on small personal loans made to an estimated 3.9 million customers. The box is still missing.

Whoops!

CitiFinancial correctly informed its own customers and, inevitably, the rest of the world about the security breach. Would they have done so entirely on their own? That is less clear. In July 2003, California started requiring companies to inform customers living in the state of any breach in security that compromises personally identifiable information. Six other states have passed similar legislation.

No such legislation exists on the federal stage, however – only discretionary guidelines for financial institutions about whether and how they should inform their customers with respect to breaches in the security of their personal information.

Both the House and Senate are now considering federal legislation similar to the California law. It’s a start but not nearly enough. We need mandatory clarity and transparency; not just with regard to the services that these miracles of microchip and satellite technology offer but also the degree to which companies share and exchange their harvest of private data.

We cannot even begin to control the growing army of businesses and industries that monitor what we buy, what we watch on television, where we drive, the debts we pay or fail to pay, our marriages and divorces, our litigations, our health and tax records and all else that may or may not yet exist on some computer tape, if we don’t fully understand everything we’re signing up for when we avail ourselves of one of these services.