Citizens' Protection in Federal Databases Act Introduced

SewersOfRivendell writes "Quote from http://boingboing.net/: 'EFF, EPIC, CDT, ACLU and Free Congress have drafted a bill that's been introduced by Senator Wyden today, for a new law called "The Citizens' Protection in Federal Databases Act." This is a hell of a law. It finds that various species of spooks are making avid use of commercial and governmental databases, merging them and aggregating them, without transparency, accountability, or any real understanding of the danger to civil liberties involved in this practice. Accordingly, it requires any Fed agency using non-Fed databases to cut it out and make a full report to Congress on who they're buying database and database-services from, what they're doing to preserve privacy, why they're doing what they're doing, and whether they actually have a realistic chance of catching any bad guys. And it calls into account Feds who abuse their authority and limits the kind of doomsday hypotheticals that can be used to justify such abuse.' PDF draft of the bill here."

Comments

Accountability?

[Empiric]

The "accountability" thing is going to be quite a trick. This is the same government, after all, whose own GAO (General Accounting Office) concluded that government agency accounting is so bad, there's no way they can determine how much the government is actually spending--and that if this degree of lax accounting was taking place in a private corporation, the owners would face legal action.

Likely responses...

[Anonymous Coward]

• cut it out - "Ok, whatever you say."
  
• make a full report to Congress - "We ran MySQL. But we stopped, umkay?"
  
• what they're doing to preserve privacy - "We have self signed SSL certificates for our intranet."
  
• why they're doing what they're doing - "To protect and serve."
  
• whether they actually have a realistic chance of catching any bad guys - "Yep. Those bad guys never stood a chance...umkay?"

Re:A good start

[SecGreen]

Buy stock in them, since if the government isn't allowed to collect and analyze the data, they will simply outsource the analysis to the private companies who aren't subject to the new law.

What's the limit for?

[Anonymous Coward]

The Attorney General, the Secretary of Defense, the Secretary of Homeland Security, the Secretary of the Treasury, the Director of Central Intelligence, and the Director of the Federal Bureau of Investigation shall each prepare...

All of the other agencies, particularly the Department of Commerce and it's Bureau of the Census, utilize numerous public databases in the process of their daily work. Why not include reports from them too?

Re:What's the limit for?

[leerpm]

Because when the Bureau of the Census screws up the information in their database for an individual, it makes narry a blip in their aggregrate stats. When the FBI screws this up, you may have agents busting your door down for no legitimate reason other than the computer says you may have links to terrorism.

Found the links I needed.

[James A. A. Joyce]

This article, while not specific to the topic I mentioned, did have a specific quote which describes exactly what I was trying to explain:

"Just by knowing the birth date and ZIP code of the governor of Massachusetts, Latanya Sweeney, a computer-privacy researcher at Carnegie Mellon University, was able to retrieve his health records from a supposedly anonymous database of state employee health-insurance claims. Sweeney also demonstrated that she could do the same for 69 percent of the 54,805 people on the voting list of Cambridge, Mass."

This is from another article, reprinted from Newsweek :

"...don't get complacent: anonymity is hard to achieve. Where once a company needed a name, address, phone number, or Social Security number to identify a person, database technology has made that unnecessary. "Eighty-seven percent of the population of the US can be uniquely identified [only] by their date of birth, gender, and five-digit zip code," says Latanya Sweeney, ALB '95 assistant professor of computer science and public policy at Carnegie Mellon University in Pittsburgh."

And finally, from Dr. Latanya Sweeney's CV itself:

"Recent work includes:

* Identifiability server -- a computational system that determines the identifiability of given data sets and/or of individuals in the United States based on either field descriptions of the data set or on actual data values. For example, combinations of values such as {date of birth, gender, 5-digit ZIP} combine to uniquely identify 87% of the population in the United States."

Good.

[softspokenrevolution]

Simply letting federal agencies run around and spy on people simply because they can doesn't seem to be the best idea for a country based on freedom and all of that jazz. Accountability is what keeps things from going bad to worse, look at dictatorships all over the planet, when people aren't held accountable for their actions they go to extremes. Americans or not, I don't fel very secure when someone can peer into any old asset of my life without asking my permission or without being checked in some fashion. I for one, feel more threatened by the current way the administration is going in regards to policy (foreign, fiscal, energy, environmental, copyright, and pretty everything else) than I do by any terrorist threat (then again, like 90% of americans I don't live in a threatened area, I likve in the 'burbs, well, the sort of burbs).

Re:It's just a draft

[Frobnicator]

This probably won't be on any .gov sites yet as it hasn't been introduced

Who moderated that thing up to informative? It specifically says "introduced by Senator Wyden today" so of course it isn't on Thomas records yet -- it takes at least 1 day for that. The ACLU has Their announcement up though.