I'm fairly ambivalent about the whole Wikileaks issue. I've long been a supporter of whistleblowing in general as companies and the governement should be held accountable for abuses and wrong-doing and often it's only fully public scandals that allow that to happen (though sometimes not even then).

Anyway, as to whether Wikileaks has done anything wrong, one must first ask if there was anything posted that caused significantly more harm than good (which so far has been a "no" it seems).

But to the point, Wikileaks is expected to release a lot of data about Bank of America very soon. There's a lot of speculation, but more interestingly, there are reports that Bank of America is preparing focused teams to respond to whatever drops when it drops.

I look forward to seeing how slime covered that rock is when it's lifted.

The Federal Trade Commission proposed a new standard of privacy in American Industry recently:

“Despite some good actors, self-regulation of privacy has not worked adequately and is not working adequately for American consumers,” Jon Leibowitz, the chairman of the trade commission, said. “We’d like to see companies work a lot faster to make consumer choice easier.”

No kidding? Companies won't regulate themselves? Unbelievable!

Anyway, the article goes on to say:

The online advertising industry, Mr. Zaneis said, would suffer “significant economic harm” if the government controlled the do-not-track mechanism and there was “a high participation rate similar to that of do not call.” Mr. Zaneis said the industry would continue to build upon a self-regulatory framework and had recently put in place the use of icons on select online advertisements that allow users to opt out of customized advertising.

Oh boo hoo! Companies that have been tracking and tagging you like cattle would be upset if they had to stop. Waa.

Whether or not the FTC will get traction with this is uncertain, but it won't matter much if it's built into the browser AS IT SHOULD BE. Fortunately, Firefox at least is looking into this in an upcoming version.

This isn't what it would look like though...

It'd be nice if they could post an actual picture of a backscatter scan instead of a full x-ray, but this is still pretty cool. I personally wouldn't buy one since I'd rather not be scanned at all than try to make a statement after the fact.

Check these out

Also a series of current articles and links about the issue here.

And finally a story of a pat down that’s been resurrected from 2002 by Penn of Penn and Teller.

The TSA has constantly said that photos from the nudie scanners wouldn't be stored and therefore all us privacy nuts were just being paranoid.

However, when the government says "trust us" and doesn't provide either visibility or accountability, why are we wrong when we say "NO"?

Case in point: this story of nudie scanners where over 35000 photos were stored. Whoops.

To be fair, this wasn't the TSA, but US Marshalls in an Orlando courthouse, but the technology makes it possible. If the only thing that stops someone from recording a pic is a setting on the machine, I don't feel very safe.

Maybe you haven't heard of this yet, but a pilot working for ExpressJet refused to use the new nudie scanners installed at his airport. They offered to pat him down instead, but according to him:

"Pat down is misleading," Roberts explained. "They concentrate on the area between the upper thighs and torso, and they're not just patting people's arms and legs, they're grabbing and groping and prodding pretty aggressively."

I've written about this previously as it's been reported that refusing the scanner will get you a ''super-sized'' pat-down almost like a punishment and this experience seems to confirm that.

Peter Pietra, the head of privacy for the TSA is a reasonable guy who I met at a conference once. I asked him about this issue and he stated that the procedures seemed to work as intended. People have the right to opt out, but must be patted down in the process. I asked him about the "aggressive pat-down" and he said this:

There is no retaliatory pat-down for people who decline AIT. There used to be several types of pat-downs, but there are now only two (standard, and resolution). People who decline AIT or metal detector, for that matter, get the standard pat-down, but our standard pat-down changed about a month ago …. There was a flurry of media attention about a month ago on it, and some complaints following the news articles, but not a lot. My rough recollection is a dozen or fewer complaints specific to the new pat-down.

Along with my previous talks with him, this is the second time he's assured me that there is no special treatment of people who refuse the scan. While I'm positive there are people who abuse their authority or make things tougher for people who they think make things tough for them (asserting rights which also makes their job harder), here's the thing:

There are two pat-downs and while I don't know what warrants the second, you should only get the first by refusing to be scanned. Therefore, if your pat down is more extensive than what you see old people with heart devices getting, it's time to complain and complain loudly (which is what I believe this pilot has done and good for him). Peter says he thinks there's no problem because he hasn't received many complaints. If you think you've been a victim of retaliation or excessive probing, make sure he hears about it.

Make sure your voice is heard. You can connect with his office here: TSAPrivacy@dhs.gov

Support for the Pilot

There's been a lot of support for him in the airline industry (among workers not officially). Here are some of the industry forums where they're talking about him:

Jetcareers
Expressjetpilots
Flyertalk

Why on Earth would anyone be surprised that when someone has access to a lot of sensitive data about people they know, they'd be tempted to look at it? Check out this story outlining several recent cases of government workers peeping on people with government databases.

Creation of government databases should be limited. Any that are legitimately created must be carefully controlled and restricted to only the people that need it. Breaches of trust should be visible and accounted for.

As far as I'm concerned, private databases owned by companies should fall into the same boat. No one should be tracked and tagged like an animal unless they're a convicted criminal.

From the Washington Post:

Last week, the D.C. Board of Elections and Ethics opened a new Internet-based voting system for a weeklong test period, inviting computer experts from all corners to prod its vulnerabilities in the spirit of "give it your best shot." Well, the hackers gave it their best shot — and midday Friday, the trial period was suspended, with the board citing "usability issues brought to our attention." Here's one of those issues: After casting a vote, according to test observers, the Web site played "Hail to the Victors" — the University of Michigan fight song.

Whoah! E-voting not secure? Where have we heard that before!? And the best part is that it doesn't even take the vile hacker underground to do it. It's the college researchers each time.

No knock against college researchers, but for e-voting to work, it should take a vast conspiracy spanning several continents and special agents who jump from helicopters in the night to break into buildings through air-ducts not some mostly-sober frat boy. They obviously have no idea what they're doing and should stop. Now.

About the only ray of light in this whole story is that they were smart enough to challenge the public to hack them thus making their failure obvious (and therefore correctable).

E-voting will come eventually, but not now and probably not for a long time. Wait… Scratch that. It WILL come, but it won't be ready, it won't be secure, and we'll all suffer for it (like we did the last time).

It seems there’s a been a big push recently to punish those naughty whistleblowers who leaked government secrets and put everyone in danger. The only problem is, they didn’t leak any secrets or put anyone in danger. Instead, they embarrassed their leaders and paid the price.

Surprise, surprise. A company has giant data breach due to negligent security, but not to worry! They'll protect you by offering you credit monitoring for one year free!

It would be nice if people could spot this B.S. easily by now, but I'm guessing there are a lot that won't so let me spell it out. Credit monitoring is a waste of your time and is likely only offered to make it seem like they're doing something for you when they probably don't. I wouldn't be surprised to find out that the credit monitoring companies have a "data breach plan" where companies can get a bulk discount by offering monitoring to all their victims.

It's a classic win-win-lose. The breach company wins PR points, the monitoring companies continue to make money for not providing any real service, and we all lose.

If you're worried about id theft, just freeze your credit reports!