This is a live blog of the Security and Liberty Forum at UNC. The final agenda looks like this.

PT Wright of Homeland Security has canceled.

Christian Stalberg of NC-CLU, one of the organizers welcomes us. (Joey is taping the Forum for ibiblio). Don’t drink the water or wash your hands — lead (and I saw gravel literally) in the water).

State Senator Janet Cowell (D-Wake), co-Chair of the Information Tech Committee.

Katherine Bryant, consumer advocate for ChoicePoint on consumer rights – she explains Choicepoint and about their 2005 social engineering break-in. Lists Choicepoint’s consumer’s rights list. (slides will be online? think so). Fair Credit Reporting Act. 30 states have their own fair credit statues in addition. Gramm-Leach-Biley Act about sharing personal info about individuals). Family’s Educational Right to Privacy Act. Children’s Online Right to Privacy Protection Act. Health Insurance Portability and Accountability Act.

How to get your Choicepoint file: call 1-888-395-0012

Next up is Jim Harper director of Information Policy Studies at Cato Institute on Data Mining, Sharing and Brokering, the Author of Identity Crisis: How Identification is Overused and Misunderstood, and blogger of Privacilla.

Someone was stopped because of photographing the interior of a Metro station in DC yesterday. He sees this one as a failed analysis of pattern recognition behavior yielding a false positive.

He next disses datamining to try to detect terrorists as bad use of datamining. Not enough examples of terrorists planning to help mine. You will only get false positives which costs too much and impinges on our liberties — dissing Total Info Awareness in this respect. Instead link analysis would have yielded better and more accurate results including 9/11 terrorist. He demands transparency (ala Choicepoint).

Barry Steinhardt of ACLU – Directory of ACLU on Technology and Liberty. On Real ID (ACLU site – – a federalized driver’s license with consistant data but would yield a national id card managed by Homeland Security. As you might expect, Barry and ACLU don’t like Read ID.
A bit about the Surveillance Industrial Complex.
(hope to have these slides later too).

Terrell wants me to write down “The Billy Bob Problem” in Georgia over an attempt to inact an early version of Read ID there. “William Robert” or “Billy Bob”. A clip from to hit YouTube next week now about Real ID and a Chicago Fireman.


Melissa Ngo of EPIC on RFID issues identified by EPIC. Also she points us to Spy Chips . com.

Bruce Schneier’s flight was delayed he will be here we hope at 4:30

Gene Spafford of Purdue and the U.S. Public Policy Committee of the Association for Computing Machinery (ACM) on “Government surveillance and propensity profiling”

Annie Anton of NCSU and The Privacy Place where they have done an analysis of the Choicepoint breach – “The ChoicePoint Dilemma: How Data Brokers Should Handle the Privacy of Personal Information” (March 14, 2007) [PDF]

Annie on transparency and privacy statements. privacy def from Good luck finding the Def, I couldn’t. Now on jetBlue breach in February 04 in IEEE Security and Privacy. Now on her Choicepoint paper (above). A bit about Julie Earp and her paper on privacy policy (Requirements Engineering Journal 2004).

Additional papers reviewed. Great bit on auditing airline privacy policies – Best was Alaska and the worst was United (called ended up in India and with the answerer shouting into the phone).

Also points to


Bruce Schneier is in the building — and up next, talking on the Future of Privacy. NorthWest was his airline and he spent 3 hours in the Detroit airport.

Stirring talk which Joey is capturing for later…

In the meantime, here’s Bruce getting the EFF Pioneer Award at eTech

How much privacy would you give up for security? Bruce says that this is a false statement. Privacy is about identity. Security can be about door locks for example. The debate is liberty vs control. Government should be transparent — this reduces power and changed the imbalance of power.

Facebook exposure is fine if all are exposing. But the power imbalance of say job hiring makes it a problem. Data is the pollution problem of the information society. Overproduced and not managed or controlled. Data controls will be the equiv of pollution controls.

[brief reconfiguration for the panel of all the speakers minus Sen. Cowell]

Spafford – Are you equating a smoker with a terrorist victim? One is an actor and one an innocent bystander.
GS – It’s about risk and not necessarily about action/non-action. We need to evaluate risk and abate fear. Fear/terror itself has a cost.

Harper – I have a friend who was investigated for buying gun powder to reload shells. My friend thought this was appropriate based on pattern matching.
JH – err. maybe not. Is there evidence that folks who buy large amounts of gun powder actually commit crimes greater than those who don’t buy it. He supports a confrontation or visit by police but not a say wire tap.
BS – frames it as is it real pattern or not

Ngo – what direction is legislation likely to go as data trails increase?
MN – specific evils are being addressed — repeal real id say. but she would like to see less specific legislation that protects the person rather than attack the technology.
GS – some folks want to save you from yourself. they want to protect you from hurting your life — of afterlife!

Bryant – what information on sex offenders gives false positives?
KB – goes after the Anton study and says they have less than 1% false positive. (Anton found 70%, but looked at only 11 reports says KB).

BarryS – How has the monetary cost of real id play out in the states? If my state doesn’t participate in Real ID will I be banned from Federal Courts? (BS says No).
BarryS – quadriplegic was held in contempt for not going to a 4th floor court room. Now a riff on Real ID in all states. If the first state says no, the house of cards collapses.

Bruce S – traded a constitutional law credit for another one: Increase of occurences in false positives and the decrease in transparency in government terrorist cases.
BS – when data is collected then false positives are highly contextual. catching the liquid bombers in London (used old school specific police work). old school police work has less false positives than say a data based investigation. it’s cheaper to begin with what JH would say are pattern and association. “no fly” is a list of people who are too dangerous to fly but too innocent to be arrested. and the list completely lacks transparency and correction or inspection.
GS – US-centric review of the bias toward innocent or at least not enough to convict. National fear caused the Japanese interment. Now we put people away who might possibly be terrorist. Fear of disclosure closed the courts and stalls justice.
JH – talks about gov secrecy. Secrecy: The American Experience by Daniel Patrick Moynihan
BarryS – tells of a meeting with Homeland Security about how to do physical searches. So your metal detectors don’t work, when will you be using partical detectors? HS I cannot tell you if a metal detectors detect plastic. BS – no one expects it to detect anything other than metal. HS – that is a secret that i cannot reveal.

Bruce has ended up with all the questions.

BruceS – Can technology protect privacy etc?
BS – not without a corresponding legal framework
GS – those who need it don’t have the skills. we are the ones who protect our freedoms; not techology.

KB – in 2000, choicepoint provided a list of voters with names “like” convicts which disenfranchised a lot of voters. what is choicepoint doing to prevent doing that again.
KB – we were buying the company that did that and we won’t do it again.

BarryS – does the constitution protect our privacy? if not do we need an amendment?
BarryS – no not explicitly. but the 4th has been used. but the new interpretation of the 4th, he says, eviscerated the 4th by an interpretation of what is “public.” he sees hope in the states and cites the state of Washington as a good example.
JH – says that there are many dimensions of privacy and there couldn’t be an amendment crafted to work for you. He rejects government’s attempt
Daniel Solove‘s taxonomy of privacy (at GW)