Select Committee on Home Affairs Written Evidence


APPENDIX 40

Memorandum submitted by Randal Gainer, Partner, Davis Wright Tremaine LLP

EXECUTIVE SUMMARY

  1.  The personal information and payment card data of millions of individuals in the United States have been obtained by thieves who have electronically penetrated commercial and government databases and have stolen laptops and other computer hardware. In the one-year period ending September 2006, criminals used such stolen data to commit fraud against more that eight million individuals in the US Data breach notice laws in the US have exposed the breadth of this problem but have not motivated data controllers to implement adequate data security measures. New laws that are currently being proposed and adopted in the US will shift costs incurred due to data thefts from banks and individuals that currently bear those costs to organizations from which data are stolen if the organizations fail to implement certain data security measures. Mr Gainer advises businesses in the US regarding their legal duties to implement data security measures and to respond to data thefts. His testimony addresses the positive features and shortcomings of current US data breach notice laws and the new cost-shifting laws.

  2.  Mr Gainer is also co-counsel with lawyers from the American Civil Liberties Union in a lawsuit against the US National Security Agency regarding the NSA's interception of phone calls and emails of US persons and the NSA's data mining of telephone call records. He will testify about some of the issues raised by that case and will recommend certain restrictions on governments' use of data mining.

TESTIMONY

  3.  Thank you, Chairman Denham and members of the Committee for this opportunity to address some of the issues raised by the "Surveillance Society" report drafted for Commissioner Thomas. The report highlights serious threats to the privacy of residents of the U.K and of other countries, including the US I address here two issues raised by the report with which I have experience in the US: protecting the security of computerized consumer data and regulating government anti-terrorism surveillance. My testimony reflects my own views and not necessarily those of my firm, our clients, or my co-counsel at the ACLU.

The Positive Effects and Limitations of U.S. Data Breach Notice Laws

  4.  I represent businesses in matters that involve computer technology. In the last few years, I have assisted many businesses regarding thefts of electronic data. I would like to address some of the lessons we have learned in the US about statutes intended to protect consumer data from such thefts.

  5.  Theft of personal information is a serious problem in the US, as I understand it is in the UK In the one-year period ending September 2006, the last one-year period for which complete statistics have been reported, electronic data regarding more than 73 million individuals were stolen or lost in the US The information of at least 8.3 million of those 73 million persons was misused for fraud. Thirty-seven states in the US have enacted statutes that require entities that own or license computerized personal information about individuals to notify those individuals if unencrypted data about them is disclosed to an unauthorized person. The US Congress is considering proposed statutes that would apply across the US that would preempt these state laws and would require notice to consumers in all parts of the US in similar circumstances.

  6.  I understand that the UK has no similar data breach notice law, though some commentators have suggested that such a law should be adopted. A data breach notice law would be an important component of an effort to reduce the theft of consumer data. It would undoubtedly expose the extent of such thefts, just as such laws have done in the US Before California adopted the first US data breach law in 2003, reports of the theft of consumer data in the US were extremely rare. Now such thefts are reported daily. While there has likely been some increase in the number of such thefts between 2003 and today, it is not likely that such thefts began only after the notice laws were adopted. More likely is that organizations did not publicly disclose similar thefts that occurred before 2003.

  7.  Bringing the extent of data thefts into public view is important but it is not enough. One purpose of data breach notice laws is to expose companies and government agencies that fail to take available steps to protect data to negative publicity—with the hope that such exposure will cause them to improve their security measures. Another, important purpose is to permit potentially affected individuals and businesses to take defensive measures when individuals' data have been stolen. While the second purpose of data breach notice laws has been served by the statutes—individuals can monitor their accounts and banks and payment card companies can cancel accounts or change account numbers—the first purpose, improving security, has not been well-served by these statutes.

  8.  As part of my practice, I attempt to persuade business officials that they should take additional steps to protect consumer data. I regularly advise them that such preventive measures will be much less expensive than the costs of litigation, payment card association fines, or government penalties, all of which are possible if a data theft occurs. Very few businesses take adequate preventative steps to protect consumer data until after thieves have stolen such information. Business managers state that tight budgets generally do not permit expenditures for preventative security assessments and corrective measures.

  9.  Further, the deluge of data theft notices that have been issued since notice laws became effective in the US in 2003-04 has caused some consumers to ignore them. Something additional must be done.

  10.  I am aware that serious criminal penalties have recently been authorized in the UK for persons who steal private data. States in the US have even harsher criminal penalties available—and they impose serious penalties on data thieves when they police catch them. For example, a contractor's employee was recently convicted of stealing data from one of my clients. He was sentenced to four years in jail. Such potential criminal penalties have not, however, prevented the widespread theft of consumer data in the US.

  11.  A new approach is beginning to be adopted in the US. Last month, Minnesota became the first state in the US to adopt a law that permits financial institutions to recover costs related to data breaches from retailers that retain consumers' payment card data longer than necessary if the card data are later stolen. Financial institutions often have to replace payment cards when card data are stolen, which can cost up to $25 per card. In the past, US courts have held that banks may not recover those costs from retailers whose poor security contributed to a data theft. Five other US states are considering proposed statutes similar to the Minnesota law. AB 779, pending in California, would permit any owner or licensor of personal data to recover costs to send notices to affected individuals that are incurred after data are stolen from a business covered by California's data breach notice law.

  12.  Even these proposed new laws do not address a huge component of the financial costs of data thefts: pursuant to payment card association rules and standard payment card contracts, if a merchant accepts a fraudulent card for a transaction, the merchant will have to absorb the cost of the fraud. The cardholder is protected from having to pay such fraudulent charges by federal law in the US and by card issuers' policies. Card issuing banks are permitted to chargeback the losses to the merchant; therefore, unless the merchant has gone out of business, the issuer is protected as well. Merchants who get stuck with fraudulent charges typically pass those charges on to consumers by raising prices, ie, merchants adjust their prices to compensate for fraud losses. As is too often the case, it is the public that is penalized in the end.

  13.  If the best features of the recently enacted Minnesota statute and the other pending bills were combined, this outcome could be avoided. Any individual or business that incurs costs of any kind due to a data breach that was caused, in part, by another business's poor security measures should be able to recover those costs from the negligent business. Adequate security standards exist to determine whether a business has deployed adequate security, including the Payment Card Industry Data Security Standards and ISO 17799. Standards are not the problem. Failure to implement recommended security measures is the problem.

  14.  If such cost-shifting were authorized, negligent business would pay rather than consumers. Perhaps the risk of incurring such potential costs would motivate businesses to take additional steps to protect consumer data. Experience in the US shows that, until businesses (and perhaps government agencies) are threatened with paying for the costs of lax data security, many will fail to implement security measures that could prevent data thefts. Data controllers know that if a thief steals consumer data, others will bear most of the costs.

  15.  Some businesses do implement state of the art data security measures and they should be applauded. But the epidemic of thefts shows that data security is not the priority it should be.

  16.  Shifting the costs of data breaches has two additional benefits: it is fair—the negligent party pays—and it harnesses the power of economic incentives. Relying on mere shaming of data controllers has proven inadequate.

  17.  Cost-shifting could be adapted to the UKs regulatory approach to protecting data. The Information Commissioner could be authorized to order such cost-shifting if his investigation determines it is warranted.

The ACLU Litigation Against the National Security Agency

  18.  As you know, The New York Times disclosed the NSA's domestic surveillance program in December 2005. Two aspects of the NSA program were disclosed by the Times and by other media. One part of the surveillance program was the interception of emails and phone calls between US persons and non-US persons without either a criminal warrant or an order from the Foreign Intelligence Surveillance Court. The FIS Court is a specialized US court that considers government requests to authorize surveillance of foreign governments and terrorists. President Bush publicly admitted that he had authorized the phone call and email interception parts of the NSA program. The second aspect of the NSA program was the data mining of US persons' telephone call records to try to identify terrorists, which was also done without a warrant or FIS Court order.

  19.  The ACLU challenged the NSA program because the US Foreign Intelligence Surveillance Act, adopted in 1978 after politically motivated spying on US citizens by US intelligence agencies was exposed, requires domestic foreign intelligence surveillance to be conducted only as authorized by the FIS Court. The ACLU also claims that the NSA program violates US persons' free speech and due process rights. The ACLU challenged both aspects of the NSA program in federal court in Detroit.

  20.  I volunteered to help the ACLU and asked for help from other lawyers in our firm. More than a dozen attorneys in our offices have helped the very capable lawyers of the ACLU's national office with the litigation. We are doing that work pro bono. Such work by US attorneys is not unique. Others of my partners are representing prisoners at the Guantanamo Bay detention center. Lawyers from many other US law firms are similarly representing clients challenging US government actions that violate US and international law.

  21.  In addition to the ACLU lawsuit, more than 20 cases were filed in numerous cities across the US that challenged telephone companies' disclosure of call records to the NSA. Such disclosures are prohibited by US statutes in most circumstances and the statutes provide substantial financial penalties for each instance of unauthorized disclosure of call record data. The lawsuits against the phone companies were consolidated before a federal judge in San Francisco.

  22.  In the ACLU case, we obtained declarations from the plaintiffs—criminal defense lawyers, reporters, and scholars—that showed they could no longer communicate with confidential non-US sources without putting those sources at risk. The government did not dispute that evidence but sought to have the case dismissed on the grounds that it endangered state secrets. The government also claimed we could not show that the plaintiffs were actually targets of the program. Finally, the government argued that, if the court reached the merits, it should hold that Congress authorized President Bush to conduct the surveillance as part of the Authorization for Use of Military Force in Afghanistan or that the President has inherent authority, as Commander in Chief, to conduct the program.

  23.  In August 2006, Judge Anna Diggs Taylor held that the NSA had violated FISA and the First and Fourth Amendments to the US Constitution by intercepting US emails and phone calls without FIS Court approval. She rejected the government's state secrets claim about those aspects of the program because the government had publicly admitted them. She rejected the government's remaining arguments and ordered such surveillance to be stopped. Judge Taylor dismissed our data mining claims, holding that those claims were barred by the state secrets privilege.

  24.  Each side appealed. The Court of Appeals in Cincinnati suspended the injunction until it decides the case. Just before oral argument regarding the appeal on 30 January 2007, and just before Congress began hearings about the NSA program, the government announced that the FIS Court had approved the NSA program but that the government reserved the right to re-commence it at any time without FIS Court approval.

  25.  Judge Walker also refused to dismiss the lawsuits against the phone companies, which challenged the companies' disclosure of call records to the NSA. His decision is being reviewed by an appellate court in San Francisco.

  26.  A few weeks ago, former Deputy Attorney General James Comey testified to a Senate Committee that he and former Attorney General Ashcroft concluded in 2004 that the NSA program was illegal in its then-current form and that they had refused to sign a certification as to its legality. Mr Comey described an episode during which then Whitehouse counsel and now Attorney General Gonzalez sought to get Ashcroft to sign the certification while he was hospitalized for an acute illness. Mr Comey testified that President Bush agreed that unspecified changes should be made to the NSA program after numerous Department of Justice officials, including Mr Comey, Attorney General Ashcroft, and FBI Director Mueller, threatened to resign if the illegal program continued.

  27.  The cases regarding the NSA program are important for several reasons. First, it is critical that US courts reiterate the principle that even the President must abide by statutes enacted by Congress. The rule of law requires no less.

  28.  Second, it is important that the courts reject the President's misuse of the state secrets privilege. The rule of law cannot survive if the President can break the law, admit it publicly, and then invoke the state secrets privilege to prevent judicial review of his actions.

  29.  Finally, it is important that the courts limit the government's computerized searching of billions of telephone call records of millions of individuals, whom the government does not allege have done anything wrong. If such surveillance is to be conducted, court review and supervision should be required.

DATA MINING OF GOVERNMENT AND COMMERCIAL TRANSACTION DATA

  30.  The "Surveillance Society" report discusses at pages 38-48 some of the reasons that unregulated government mining of personal data about ordinary citizens is objectionable. Other authors have described additional reasons that such government data mining should be strictly regulated.

  31.  There are at least six types of potential errors and abuses that may result from governments' counter-terrorism data mining efforts:

    —    Mistaken identity—a person with a similar name or other characteristics shared with a terrorist or criminal suspect may be misidentified as the target. This arises frequently with use of "watch lists" used to screen airline passengers.

    —    Faulty inference—information may be misinterpreted to draw an erroneous inference that someone is associated with terrorists when he is not.

    —    Intentional abuse—agents authorized to access data have performed checks for fees for private investigators.

    —    Security breaches—government data developed through data mining may be stolen or carelessly disclosed.

    —    Mission creep—systems justified to fight terrorists may be used for additional purposes, including law enforcement or increasing government control over individuals.

    —    Diminished trust—citizens may feel that they are under generalized surveillance, which will diminish their trust in government and inhibit their willingness to participate in lawful activities that may be misinterpreted, such as enrolling in pilot training.[236]

  32.  The last problem with data mining of consumer records, that it will heighten public distrust of government, is more ephemeral that the other potential abuses. It may, however, be the most important because it draws on individuals' unease about dramatic technological changes that have occurred in the last few years. Growing computer power and the declining cost of storing data make it practical for governments to store and search vast quantities of data. This, in turn, has decreased the "practical obscurity" that gave some comfort to individuals when it was impractical to collect scattered paper records and review them all. While there is still some potential obscurity that results from the massive volume of data available to governments, both from their own records and from commercial data aggregators, software search tools are rapidly improving, which is decreasing that obscurity as well.[237]

  33.  The threat to public safety has also changed. Threats are no longer posed primarily by hostile nation states. Terrorists, both those who are homegrown and those who infiltrate our borders, now threaten mass murder. Governments and individuals expect technology to be used to create actionable intelligence to identify terrorists and to prevent them from harming innocent people. US intelligence agencies' past failures to "connect the dots" have been universally criticized.

  34.  The ability to store vast amounts of data, the increasing ability to effectively search large databases, and the need to use all lawful means to prevent terrorists from carrying out their plans challenges policy makers to determine how to protect both privacy and security. Several technological tools can help and should be required:

    —    Anonymization—personally identifiable data in databases that are mined as part of counter-terrorism efforts should be anonymized. If a search produces a "hit," the specifically identified dataset can be de-anonymized. Anonymization should decrease individuals' concerns that every aspect of their lives is scrutinized.

    —    Access to data must be limited—permissioning rules for accessing the huge troves of government and commercial data that are aggregated for data mining should be built into system architecture and should be enforced.

    —    Immutable audit trails—each access to a database that contains personally identifiable data should create a log entry that cannot be changed. Such logs should be monitored to guard against intentional misuse of the data.

  35.  Requiring privacy impact statements or "surveillance impact statements" for government surveillance programs, as recommended by Commissioner Thomas, may also help if a proposed surveillance project will be stopped or revised if an impact statement shows that the project will compromise individuals' privacy without producing results adequate to justify the effect on privacy rights.

CONCLUSION

  36.  Public debate about data security and about the privacy implications of governments' use of data mining for counter-terrorism efforts is important. Commissioner Thomas's report and these hearings are valuable parts of that debate. Thank you for the opportunity to contribute.

June 2007






236   Jack X Dempsey and Paul Rosensweig, Technologies that Can Protect Privacy as Information Is Shared to Combat Terrorism, 3-4, May 26, 2004, Center for Democracy and Technology. Back

237   K . Taipale, Designing Technical Systems to Support Policy: Enterprise Architecture, Policy Appliances, and Civil Liberties, in Emergent Information Technologies and Enabling Policies for Counter-Terrorism, Robert L Popp and John Yen, editors (Wiley Interscience 2006), 444-45. Back


 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 8 June 2008