HR 822, the National Right-to-Carry Reciprocity Act of 2011-STRONGLY SUPPORTED By ISPLA!!!

Sec. 926D. Reciprocity for the carrying of certain concealed firearms

(a) Notwithstanding any provision of the law of any State or political subdivision thereof (except as provided in subsection (b)), a person who is not prohibited by Federal law from possessing, transporting, shipping, or receiving a firearm, and who is carrying a valid identification document containing a photograph of the person, and a valid license or permit which is issued pursuant to the law of a State and which permits the person to carry a concealed firearm, may possess or carry a concealed handgun (other than a machinegun or destructive device) that has been shipped or transported in interstate or foreign commerce, in any State, other than the State of residence of the person, that--

(1) has a statute that allows residents of the State to obtain licenses or permits to carry concealed firearms; or

(2) does not prohibit the carrying of concealed firearms by residents of the State for lawful purposes.

(b) The possession or carrying of a concealed handgun in a State under this section shall be subject to the same conditions and limitations, except as to eligibility to possess or carry, imposed by or under Federal or State law or the law of a political subdivision of a State, that apply to the possession or carrying of a concealed handgun by residents of the State or political subdivision who are licensed by the State or political subdivision to do so, or not prohibited by the State from doing so.

(c) In subsection (a), the term `identification document' means a document made or issued by or under the authority of the United States Government, a State, or a political subdivision of a State which, when completed with information concerning a particular individual, is of a type intended or commonly accepted for the purpose of identification of individuals

BACKGROUND AND NEED FOR THE LEGISLATION

I. THE CURRENT STATUS OF CONCEALED CARRY LAWS

In a 2008 opinion striking down Washington D.C.'s district-wide handgun ban, the U.S. Supreme Court recognized `that the Second Amendment conferred an individual right to keep and bear arms' that stems in large part from the right to protect oneself, as well as `one's home and family,' from harm. See District of Columbia v. Heller, 554

Forty-nine states currently permit concealed carry in some manner. Thirty-five states have `shall issue' permit laws, which generally require states to issue a concealed carry permit or license to people who meet the legal requirements. Ten states--plus the Virgin Islands, Puerto Rico, and

Twenty-five states allow non-residents to apply for a concealed carry permit or license, and

A majority of states currently extend reciprocal concealed carry privileges to varying degrees to the residents of other states. Fourteen states grant outright recognition of all valid permits issued by another state. Ten states automatically recognize permits from other states that also recognize their permits. Sixteen states will recognize another state's concealed carry permit if certain conditions are met. Only ten states do not recognize a concealed carry permit issued by another state in any circumstance, although many of these states do allow non-residents to apply for permits to carry a concealed handgun in the state.

Under current Federal law, certain active-duty and retired law enforcement officers are permitted to carry concealed firearms across state lines, even while off duty.

II. EFFECTS OF CONCEALED CARRY ON PUBLIC SAFETY

While there is disagreement over the benefits of carrying concealed weapons, many believe that robust concealed carry laws ultimately deter crime by making criminal acts much more risky and costly for potential law breakers. Statistics show a connection between concealed carry laws and a decrease in violent crime rates. The National Rifle Association estimates, based on data from the FBI's Annual Uniform Crime Report, that `right-to-carry' states (i.e., those that widely allow concealed carry) have 22 percent lower total violent crime rates, 30 percent lower murder rates, 46 percent lower robbery rates, and 12 percent lower aggravated assault rates, as compared to the rest of the country. 

A study of the effect of concealed carry laws on crime rates, published in 1997, estimated that `[w]hen state concealed handgun laws went into effect in a county, murders fell by 7.65 percent, and rapes and aggravated assaults fell by 5 and 7 percent.'

III. NATIONAL RECIPROCITY UNDER H.R. 822

H.R. 822 would allow persons with valid state-issued concealed firearm permits or licenses to carry a concealed firearm in all other states that also issue concealed firearm permits or licenses, or in any other state that does not generally prohibit the carrying of concealed firearms. This legislation would not create a national licensing scheme, but rather would require states that currently permit people to carry concealed firearms to recognize other states' valid concealed carry permits.

H.R. 822, as clarified by the substitute manager's amendment, does not affect a state's ability to set eligibility requirements for its own residents. The bill instead makes clear that a person cannot use this Federal grant of reciprocity to carry a concealed weapon in his or her own state of residence under another state's permit or license, unless their own state's laws permit this. H.R. 822 also does not impact state laws governing how concealed firearms are possessed or carried within the various states. All state, federal, and local laws regarding the possession and carrying of a concealed handgun that would apply to a resident of a state will also apply in equal force to a non-resident. A non-resident who is able to show both a valid identification document and a valid concealed carry permit or license will be permitted to carry a concealed firearm in the same manner as a resident holding a general-use permit or license.

H.R. 822 addresses concerns regarding law enforcement's ability to confirm the validity of an out-of-state concealed carry permit by requiring that a person show both a valid government-issued identification document, such as a license or passport, and a valid concealed carry license or permit. The states are also currently able to verify the validity of out-of-state concealed permits. The Nlets system, formerly the National Law Enforcement Teletype System, permits federal, state, and local law enforcement to query handgun permit information for 12 states that have elected to participate in the program. Law enforcement can also use Nlets to send inquiries regarding concealed carry permits directly to out-of-state agencies that issue permits but do not participate in the Nlets concealed carry program. Forty states currently grant some form of reciprocity for out-of-state concealed carry permits and all of the states are subject to the Firearms Owners` Protection Act's Safe Passage Provision, codified at 18 U.S.C. Sec. 926A, which provides a process by which non-residents can transport lawful firearms through states where they could not otherwise carry the firearm. Accordingly, law enforcement is already very familiar with handling and verifying firearms carried by non-residents.

HEARINGS

The Committee's Subcommittee on Crime, Terrorism, and Homeland Security held 1 day of hearings on H.R. 822 on September 13, 2011. Testimony was received from Joyce Lee Malcolm, Professor, George Mason University School of Law; David Kopel, Research Director, Independence Institute and Adjunct Professor, Denver University Sturm College of Law; and Philadelphia Police Commissioner Charles Ramsey, with additional material submitted by the International Association of Chiefs of Police, Mayors Against Illegal Guns, the Minnesota Chiefs of Police, and the Virginia Association of Chiefs of Police.

DISSENTING VIEWS

INTRODUCTION

H.R. 822, the `National Right-to-Carry Reciprocity Act of 2011,' is a dangerous bill that would override the laws of almost every state by obliging each to accept concealed handgun carry permits from every other state, even if the permit holder would not be allowed to carry or even possess a handgun in the state where he or she is traveling. The law tramples federalism and endangers public safety.

The harmful impact of this legislation is without doubt. For example, some states require an individual to show that he or she knows how to use a firearm or meet minimum training standards before obtaining a concealed carry license. Under H.R. 822, however, these states would be forced to allow out-of-state visitors to carry concealed weapons even if they do not meet that state's concealed licensing standards concerning basic gun safety or training requirements. During consideration of the bill, numerous amendments were offered by the Minority to address these serious flaws, but none were adopted. Members of the Majority blocked amendments to preserve the application of state laws concerning eligibility to carry concealed weapons within their borders, as well as other amendments that would have allowed states to prevent concealed carrying of handguns by those with out of state permits with convictions for offenses such as misdemeanor assault on police officers and misdemeanor sex offenses against children.

Recognizing the danger that it would pose to our citizens and to law enforcement officers across this country, this bill is opposed by more than 550 mayors (represented by Mayors Against Illegal Guns),  major police organizations, domestic violence abuse victim advocates, prosecutors, and faith-based organizations.

Police groups opposing the bill included the International Association of Chiefs of Police; Major Cities Chiefs Association; the Police Foundation, National Latino Peace Officers Association; and National Organization of Black Law Enforcement Executives. Among the state and local police organizations and individuals opposing the bill are the California Police Chiefs Association; the Colorado Association of Chiefs of Police; Colorado Springs Police Chief Richard Myers; Boston Police Commissioner Edward Davis; Las Vegas Metropolitan Police Department Sheriff Douglas Gillespie; the Virginia Association of Chiefs of Police; Minneapolis Chief of Police Timothy Dolan; Duluth Police Chief Gordon Ramsay; Burlington North Carolina Chief of Police Michael Williams; New York City Police Commissioner Raymond W. Kelly; and Portland Maine Chief of Police James E. Craig. Domestic violence abuse victims’ advocates oppose this bill, including the National Network to End Domestic Violence (a coalition of 56 domestic violence victim advocacy groups) and the Minnesota Domestic Abuse Project. Prosecutors opposing the bill, include the Association of Prosecuting Attorneys; the American Bar Association; Minneapolis Office of the City Attorney Susan Segal; Bronx County (NY) District Attorney Robert Johnson; Kings County (NY) District Attorney Charles Hynes; Queens County (NY) District Attorney Richard A. Brown; Richmond County (NY) District Attorney Daniel Donovan, Jr.; New York's Special Narcotics Prosecutor Bridget G. Brennan; New York County (NY) District Attorney Robert Morris Morgenthau; New Jersey Attorney General Anne Milgram; Delaware Acting Attorney General Richard Gebelein; Iowa Attorney General Tom Miller; Illinois Attorney General Lisa Madigan; Colorado Association of Chiefs of Police; Broomfield (CO) Police Chief Thomas Deland; Colorado Springs (CO) Police Chief Richard Myers; and Wheat Ridge (CO) Police Chief Daniel G. Brennan. Faith-based organizations opposing the bill include Faiths United, a coalition of more than 30 religious organizations. Our Lives, Our Laws: People Who Care, http://www.ourlivesourlaws.org/people-who-care.]

For these reasons, and those stated below, we urge our colleagues to oppose this seriously flawed legislation and respectfully dissent.

DESCRIPTION AND BACKGROUND

H.R. 822 disregards state laws by forcing states to allow the carrying of loaded, concealed weapons by any individual permitted to carry concealed weapons in another state. Section 2 of H.R. 822, as amended by the Committee, sets forth the bill's operative provisions and makes clear that the intent of this legislation is to override the will of the states with regard to who may carry concealed handguns within their borders. It provides that an individual who is not prohibited by federal law from possessing firearms and who is carrying a valid identification document containing a photograph of such individual and a valid concealed carry permit issued by a state, may carry a concealed handgun in another state if the other state has a statute that allows the issuance of concealed carry permits or does not prohibit the carrying of concealed firearms. Section 2(b) provides that an individual carrying a concealed handgun in a state must be permitted to carry the gun subject to `the same conditions and limitations, except as to eligibility to possess or carry,' imposed by federal, state or local law that apply to the possession or carrying of a concealed handgun by residents of that state.

In effect, the bill would reduce all states to the lowest common denominator of concealed carry laws, and would subject citizens to unnecessary public safety risks, contrary to the judgments made by the individual states. As Philadelphia Police Commissioner Charles Ramsey stated, `We have a uniquely diverse nation. What works where I currently serve as Commissioner in Philadelphia, and the Commonwealth of Pennsylvania, does not work for our neighbor across the river in

The Courts have found that States are within their lawful constitutional power to set minimum public safety standards for carrying concealed guns. The Supreme Court has stated that even prohibitions on concealed carrying are permissible. In

The Court thus reaffirmed its ruling in Robertson v. Baldwin that `the right of the people to keep and bear arms (article 2) is not infringed by laws prohibiting the carrying of concealed weapons.'

Since Heller, courts throughout the

This emphasis on the Second Amendment's protection of the right to keep and bear arms for the purpose of `self-defense in the home' permeates the Court's decision and forms the basis for its holding--which, despite the Court's broad analysis of the Second Amendment's text and historical underpinnings, is actually quite narrow.

The language of Heller makes clear that the Court recognized `not a right to keep and carry any weapon whatsoever in any manner whatsoever and for whatever purpose' but rather a much narrower right--namely the `right of law-abiding, responsible citizens to use arms in defense of hearth and home.

In

The Fourth Circuit cautioned further that the danger posed by guns `would rise exponentially as one moved the right from the home to the public square. If ever there was an occasion for restraint, this would seem to be it. There is much to be said for a course of simple caution.'

Many other courts have similarly reached this conclusion. 

In sum, the courts are in accord that there is no constitutional right to carry loaded guns outside the home, and certainly not to carry concealed guns in public spaces. State laws governing such conduct, directly bearing on questions of public safety, should therefore not be nullified by Congress.

See, e.g, People v. Aguillar, 944 N.E. 2d 816 (Ill. App. Ct. 2011) (stating `the decisions in Heller and McDonald were limited to interpreting the second amendment's protection of the right to possess handguns in the home, not the right to possess handguns outside the home'); Gonzalez v. Village of W. Milwaukee, No. 09cv0384, 2010 WL 1904977 (E.D. Wis. May 11, 2010) (stating that the `Supreme Court has never held that the Second Amendment protects the carrying of guns outside the home'); United States v. Hart, 725 F. Supp. 2d. 56 (D. Mass. 2010) (`Heller does not hold, nor even suggest, that concealed weapons laws are unconstitutional.'); In re Factor, 2010 WL 1753307 (N.J. Super. Ct. App. Div. Apr. 21, 2010) (stating that the `United States Supreme Court has not held or even implied that the Second Amendment prohibits laws that restrict carrying of concealed weapons'); Dorr v. Weber, 2010 WL 1976743 (N.D. Iowa, May 18, 2010) (stating that a `right to carry a concealed weapon under the Second Amendment has not been recognized to date'); Teng v. Town of Kensington, No. 09cv8jl, 2010 WL 596526 (D.N.H. Feb. 17, 2010) (`Given that Heller refers to outright `prohibition on carrying concealed weapons' as `presumptively lawful,' far lesser restrictions of the sort imposed here clearly do not violate the Second Amendment.'); United States v. Tooley, 717 F. Supp. 2d 580 (S.D.W.Va. 2010) (`Additionally, possession of a firearm outside of the home or for purposes other than self-defense in the home are not within the `core' of the Second Amendment right as defined by Heller.'); Riddick v. United States, 995 A.2d 212 (D.C. 2010) (stating that Second Amendment does not `compel the District to license a resident to carry and possess a handgun outside the confines of his home, however broadly defined'); State v. Knight, 218 P.3d 1177 (Kan. Ct. App. 2009) (`It is clear that the [Heller] Court was drawing a narrow line regarding the violations related solely to use of a handgun in the home for self-defense purposes. [The defendant's] argument, that Heller conferred on an individual the right to carry a concealed firearm, is unpersuasive.').

CONCERNS WITH H.R. 822

I. IMPOSING NATIONAL CONCEALED CARRY RECIPROCITY INFRINGES STATES' RIGHTS TO PROTECT THEIR CITIZENS FROM GUN VIOLENCE

A. ÌH.R. 822 Would

H.R.822 eviscerates the authority of states to set their own eligibility standards for who may carry a concealed, loaded gun in public. State officials, law enforcement, and legislators are in the best position to decide crime-fighting policies for their respective jurisdictions. For example, rural areas may not fit the needs of big cities and vice-versa.

States often set standards for carrying handguns on city streets that include criteria that exceed the requirement that an applicant pass a federal background check. For instance, many states, including those with strong gun rights traditions, have enacted laws that prohibit concealed handgun carrying by certain categories of individuals. These include teenagers, alcohol abusers, and individuals who pose a danger to others, or those who have not completed basic safety training. Some states also include individuals who have been convicted of certain violent misdemeanors, providing an even greater degree of protection than the prohibition in Federal law against gun possession by felons. 

The following identifies the various state requirements on applicants for concealed carry permits:

Thirty-five states require gun safety training, of which require live fire drills or other proof of competency with a firearm. The following states require training: Alaska, Arkansas, Arizona, California, Colorado, Connecticut, Delaware, Florida, Hawaii, Iowa, Kansas, Kentucky, Louisiana, Massachusetts, Maine, Michigan, Minnesota, Missouri, Montana, North Carolina, Nebraska, New Jersey, New Mexico, Nevada, Ohio, Oklahoma, Oregon, Rhode Island, South Carolina, Tennessee, Texas, Utah, Wisconsin, West Virginia, and

The following states require live fire training: Arkansas, Delaware, Hawaii, Kansas, Kentucky, Michigan, Minnesota, Missouri, North Carolina, New Jersey, New Mexico, Ohio, Oklahoma, Rhode Island, South Carolina, Tennessee, Texas, and West Virginia.

Thirty-eight states prohibit individuals convicted of certain misdemeanor crimes from carrying concealed firearms, including Pennsylvania, which bars carrying by those who have been convicted of stalking, impersonating a law enforcement officer and other dangerous misdemeanor offenses. Research supports these restrictions. For example, one study found handgun buyers who have been convicted of just one misdemeanor are almost five times as likely to be convicted of a serious violent crime as handgun buyers with no criminal record.

Garen Wintemute et al., Prior misdemeanor convictions as a risk factor for later violent and firearm-related criminal activity among authorized purchasers of handguns, J. Am. Medical Ass'n 1998, 280:2083-2087.

Thirty-six states prohibit youths age 20 and under from obtaining a concealed carry permit, including Colorado and

The following states prohibit carrying by people under the age of 21: Alaska, Arkansas, Arizona, Colorado, Connecticut, Florida,

Twenty-nine states prohibit alcohol abusers from obtaining a concealed carry permit, including

The following states prohibit carrying by alcohol abusers: Alabama, Arkansas, Colorado, Florida,

Twenty-four states grant law enforcement agencies discretion to approve or deny carry permits to an applicant who appears to be dangerous, including Alabama, which allows sheriffs to grant or deny licenses based on whether `it appears that the applicant . . . has any . . . proper reason for carrying a pistol, and [whether] he or she is a suitable person to be so licensed.

 Ten states grant broad discretion to approve or deny concealed carry permits (Alabama, California, Connecticut, Delaware, Hawaii, Massachusetts, Maryland, New Jersey, New York, and Rhode Island); 14 states granted limited discretion to do so (Arkansas, Colorado, Iowa, Indiana, Maine, Michigan, Minnesota, Missouri, Montana, New Hampshire, Oregon, Pennsylvania, Utah, and Wyoming).

Some states have voluntarily entered into reciprocity agreements with other states. These agreements vary from state to state. Ten states honor concealed carry permits issued in any other state and three states allow carrying by nonresidents without a permit. These states are the following: Iowa, Idaho, Indiana, Kentucky, Michigan, Missouri, Oklahoma, South Dakota, Tennessee, and

Some states have recently tightened the requirements for their residents to obtain out-of-state carry permits and cancelled reciprocity agreements with states that no longer meet minimum standards. For example, New Mexico and Nevada both stopped recognizing concealed carry permits issued by

H.R. 822, however, would override these State determinations and would force States to recognize all concealed carry permits regardless of the issuing State's standards.

H.R. 822's infringement on states' rights is underscored by the substitute amendment, offered by Congressman Trent Franks (R-AZ), which the Committee adopted. The amendment exempts the possession and carrying of concealed handguns under the bill from state conditions and limitations `as to eligibility to possess and carry.

Unfortunately, by a vote of 12 to 18, the Committee failed to adopt the amendment offered by Ranking Minority Member John Conyers to eliminate this specific provision from the substitute amendment. As a result, this legislation would override all of these carefully deliberated state and local policies, reducing concealed carry permitting to a new federal lowest common denominator.

Many states have determined that persons convicted of certain misdemeanors should not be allowed to carry concealed handguns within their borders. This is their considered judgment based on debate within their legislatures. As one study shows, misdemeanants who buy handguns are more likely to commit future crimes than other handgun buyers:

Buyers who had at least one misdemeanor conviction were 7.5 times as likely to be charged with a new offense as buyers who had no record.

The more past misdemeanors a gun buyer had, the more likely he or she would be charged with a further offense after the purchase.

Men who had one violent misdemeanor conviction were 9.3 times as likely to be charged with a new offense as men who had no record.

Men with two or more violent misdemeanor convictions who bought a handgun were 15 times as likely to be charged with a serious violent crime as men with no record who bought handguns.

Misdemeanor sex offense against a child: Federal law prohibits possession of guns by felons, including people convicted of felony sex crimes, but not by individuals convicted of misdemeanor sex crimes. Some states have nonetheless decided to deny permits to carry concealed, loaded guns to individuals convicted of dangerous misdemeanors, including sex crimes against children. For example,

In addition, 14 states require concealed carry permit applicants to demonstrate good moral character, including--for example--a record free of criminal convictions and 10 states grant law enforcement broad discretion to deny permits to carry concealed, loaded guns based on an applicant's record or other factors. 

Bruce Hulme, ISPLA Director of Government Affairs www.ISPLA.org

The Definitive Organization Lobbying For Investigative and Security Professionals

Click here to read the Administrative Office news release:  FEDERAL REGISTER ANNOUNCEMENT.pdf

ISPLA has learned of a shocking development within the US District Court system that will eliminate the ability of professional investigators to search federal court records created before 1995.  The implications of this new policy are far reaching and potentially devastating to the people we represent. 

The Administrative Office (AO) of the United States has announced that on April 1, 2011, it will begin destroying archived records of federal district court cases which were filed after 1969 and which were archived during the period 1970 to 1995. For example, more than 25,000 cases from the Western District of Michigan alone will be destroyed.   In addition, myriad other federal records are also slated to shredded, including records of the Federal Maritime Commission, Department of the Interior, Department of Justice, and the US Bankruptcy Court.

When a case filed in the district court has been closed, the file is maintained by the District Court for a period of time, but it is ultimately transferred to the National Archives. To reduce the cost of preserving these records, the AO has decided to discard approximately 80% of them. The AO has no plans to preserve these records electronically. Only the Judgments and the docket sheets of the discarded cases will be kept.

Imagine the consequences of this proposed action.  Background checks on litigants, potential business partners and prospective employees will be seriously hampered;  critical appellate information will be erased; 

The wanton destruction of an entire generation of public records is utterly unacceptable and action must be taken to prohibit this from occurring.

Since there was no public comment period, ISPLA is preparing a response to the National Archive and Records Administration and will represent the profession in objecting to this poorly conceived policy.

Today, Representative Mary Bono Mack [R-CA-45], Subcommittee Chair of House Energy and Commerce Committee is expected to mark up her H.R. 2577, the Secure and Fortify Electronic (SAFE) Data Act which will require companies to notify law enforcement of security data breaches without "unreasonable delay" and　 notify each person affected by such breaches within 48 hours. Her bill would preempt a patchwork of state data breach security laws, setting one national standard. As written, it is the best one presently being offered from the perspective of investigative and security professionals. It does not reference pretexting, as others do. ISPLA and other like-minded stakeholders are lobbying to ensure that any onerous amendments offered to this bill fail. We also note that our NCISS-PAC colleagues have recently contributed to the re-election campaign of Congresswoman Mary Bono Mack, their first and only PAC contribution since forming their PAC last year.

As a follow-up to ISPLA's ongoing comments about the phone hacking scandal in the U.K. a further example of how that scandal has implications here in the U.S. and elsewhere is reflected in a letter written yesterday by Representative Bono to telecommunication industry groups. She posed a number of questions to which she seeks answers. She wrote:

"We have all seen the headlines about the rapidly spreading phone hacking and police bribery scandal in the United Kingdom. According to press reports, a growing number of individuals in the United Kingdom are accused of unscrupulous and potentially illegal activities. Understanding that the events in the United Kingdom have not been connected to any activity within the United States, I nonetheless believe it’s critically important to ask American industries involved in all parts of the communications stream of commerce – from device manufacturers to fixed wire and wireless providers – whether they are satisfied that sufficient safeguards are in place to prevent similar privacy breaches here in the United States. As a result, I respectfully request an answer to the following questions no later than August 2, 2011.

1. As communications through voice over internet protocol (VOIP), smartphones and other mobile devices become more integrated in our daily lives, do you expect to see a rise in phone hacking here in the United States (involving both personal conversations and voicemails) as criminals search for new ways to steal valuable information such as credit card numbers, bank account numbers and Social Security numbers?

2. At present, what safeguards do your member companies employ to ensure that American consumers are adequately protected against the type of phone hacking scandal currently being investigated in the United Kingdom?

3. In the wake of this scandal, do your member companies believe it is necessary to adopt new practices to ensure that consumers in the United States are better protected in the future?

4. Do you believe existing laws and regulations adequately protect consumers in the United States from phone hacking and similar privacy breaches?

5. Approximately how many phone hacking incidents are reported by your member companies in a year? Are the number of incidents growing or declining?

6. As a matter of practice, are phone hacking incidents, or suspected incidents, reported to law enforcement agencies and regulatory agencies?

7. From a technological standpoint, how difficult is it to hack into cell phones or other mobile devices?

8. What steps can consumers take on their own to better protect their personally identifiable information when communicating through either fixed wire or wireless devices?"

ISPLA's belief is that this issue involving the Murdoch media empire has the potential for creating regulatory and legislative ramifications having detrimental consequences for professional investigators. It will adversely affect some of the proactive work ISPLA has been undertaking these past two years in Washington.

To support the ongoing work of Investigative & Security Professionals for Legislative Action please visit www.ISPLA.org

To donate to ISPLA-PAC only personal check or personal credit card accounts may be used.

Thank you.

Bruce Hulme

ISPLA Director of Government Affairs

235 N. Pine Street

Lansing, Michigan 48933

Tel: (212) 962 4054

S 1011, the Electronic Communications Privacy Act Amendments of 2011, which was finally introduced May 17 by Senator Patrick J. Leahy [D-VT], is a 25-page bill that ISPLA is presently reviewing. It is an extensive amendment to the ECPA since it was first introduced in 1986.  However, that law did not address social networking sites and smartphones. The Senator, who is chairman of the Senate Judiciary Committee, stated: "Updating this law to reflect the realities of our time is essential to ensuring that our federal privacy laws keep pace with new technologies and the new threats to our security." Although this bill is directed primarily at law enforcement, ISPLA will be watching how Section 2713 – Location tracking of electronic communication devices or use of such devices to acquire geolocation information might in the future impact private sector investigations in some areas.

Comments by Senator Leahy on the Senate floor included the recent data breaches involving Sony and Epsilon that impacted the privacy of millions of American consumers. “We are also learning that smartphones and other new mobile technologies may be using and storing our location and other sensitive information posing other new risks to privacy.  When I led the effort to write the ECPA 25 years ago, no one could have contemplated these and other emerging threats to our digital privacy. Updating this law to reflect the realities of our time is essential to ensuring that our Federal privacy laws keep pace with new technologies and the new threats to our security.”

Under the current ECPA law, a single e-mail could be subject to as many a four different levels of privacy protections, depending upon where it is stored and when it was sent. The proposed bill gets rid of the so-called “180-day rule'' and “replaces this confusing mosaic with one clear legal standard for the protection of the content of e-mails and other electronic communications.” Under the proposed bill, service providers are expressly prohibited from disclosing customer content and the government must obtain a search warrant, based on probable cause, to compel a service provider to disclose the content of a customer's electronic communications to the government.

The bill also provides consumer privacy protections for location information that is collected, used, or stored by service providers, smartphones, or other mobile technologies. It will require that the government obtain either a search warrant, or a court order under the Foreign Intelligence Surveillance Act, in order to access or use an individual's smartphone or other electronic communications device to obtain geolocation information. Senator Leahy stated there are well-balanced exceptions to the warrant requirement if the government needs to obtain location information to address an immediate threat to safety or national security, or when there is user consent or a call for emergency services. The bill also requires that the government obtain a search warrant in order to obtain contemporaneous, real-time, location information from a provider. There is an exception to the warrant requirement for emergency calls for service.

To address the role of new technologies in the changing mission of law enforcement, the bill also provides new tools to law enforcement to fight crime. It clarifies the authority under the ECPA for the government to temporarily delay notifying an individual of that fact the fact that the government has accessed the contents of their electronic communications, to protect the integrity of a government investigation. The bill also gives new authority to the government to delay notification in order to protect national security.

The ECPA Amendments Act, according to Leahy, strengthens the tools available in ECPA to protect national security and the security of computer networks. It creates a new limited exception to the nondisclosure requirements under the ECPA, so that a service provider can voluntarily disclose content to the government that is pertinent to addressing a cyberattack. To protect privacy and civil liberties, the bill also requires that, among other things, the Attorney General and the Secretary of Homeland Security submit an annual report to Congress detailing the number of accounts from which their departments received voluntary disclosures under this new cybersecurity exception.

S 1011 defines the kinds of subscriber records that the Federal Bureau of Investigations may obtain from a provider in connection with a counterintelligence investigation. This reform will help to make the process for obtaining this information more certain and efficient for both the government and providers. The Electronic Communication Privacy Act must carefully balance the interests and needs of consumers, law enforcement, and our Nation's thriving technology sector.  “The balanced reforms in this bill will help ensure that our Federal privacy laws address the many dangers to personal privacy posed by the rapid advances in electronic communications technologies” stated Senator Leahy.

H. R. 1841, the Data Accountability and Trust Act (DATA) of 2011, introduced May 11 by Representatives Cliff Stearns [R-FL-6] and Jim Matheson [D-UT-2] seeks to protect consumers by requiring reasonable security policies and procedures to protect computerized data containing personal information, and to provide for nationwide notice in the event of a security breach. This 17-page bill has been referred to the Committee on Energy and Commerce.  If passed, it will seriously affect information brokers.  Some investigative colleagues fear that investigators fall under this definition, even if they are not customarily viewed as being information brokers. ISPLA takes exception to that view, especially when one carefully reviews the Congressional intent and various specific provisions of the proposed bill. The following is the bill’s definition of an information broker.

INFORMATION BROKER- The term `information broker' means a commercial entity whose business is to collect, assemble, or maintain personal information concerning individuals who are not current or former customers of such entity in order to sell such information or provide access to such information to any nonaffiliated third party in exchange for consideration, whether such collection, assembly, or maintenance of personal information is performed by the information broker directly, or by contract or subcontract with any other entity.

LIMITATIONS- An information broker may limit the access to information required under subparagraph (B) in the following circumstances:

(I) If access of the individual to the information is limited by law or legally recognized privilege.

(II) If the information is used for a legitimate governmental or fraud prevention purpose that would be compromised by such access.

H.R. 1895, the Do Not Track Kids Act of 2011 a 32-page bill to amend the “Children’s Online Privacy Protection Act of 1998 (COPPA)” was introduced on May 13 by Representatives Edward J. Markey [D-MA-7] and Joe Barton [R-TX-6], Co-Chairman of the Bi-Partisan Congressional Privacy Caucus.

This bill will extend, enhance and update the provisions relating to the collection, use and disclosure of children’s personal information and establishes new protections for personal information of children and teens. Currently, COPPA covers children age 12 and younger, and it requires operators of commercial websites and online services directed to children 12 and younger to abide by various privacy safeguards as they collect, use, or disclose personal information about kids.
 
“Over the past several months, there has been a deluge of data leaks, breaches, and other exposures of children’s personal information,” said Rep. Markey. “When it comes to kids and their use of the Internet, it is particularly important that stringent privacy protections are applied so that children do not have their online behavior tracked or their personal information collected or disclosed.
 
“Since 1998 when I was the House author of COPPA, children are more likely to be poked, liked and friended online than on the playground. Now is the time for new legislation to protect kids and prevent them from being tracked online.
 
“The 'Do Not Track Kids Act of 2011' will ensure that kids are protected and that sensitive personal information isn't collected or used without express permission,” said Markey. “I have long believed that consumers – not corporations – should have control over their personal information, and this legislation will protect parents and kids from the dangers that can lurk in the online environment.  The Internet is like online oxygen for many kids – they can’t live without it.  We want kids to have Internet access; we also want to ensure there are appropriate safeguards. I look forward to working with Rep. Barton and my colleagues to move this much-needed legislation forward.”

“Today, I am proud reach across the aisle and join with Rep. Markey to officially introduce the Do Not Track Kids Act of 2011,” said Rep. Barton. “I believe that every American has the right to choose what they believe to be best for themselves and their children. But often times in our digital world that right is lost because your personal information is collected and stored without you ever knowing.

“This bill is a first step in putting consumers back in control.  It lets you know what types of information are being collected about your kids online and how it is being used. If you don’t like what you learn – you will now have the authority to change it with just the click of a mouse.”

“It is unacceptable for a website operator to act as a dictator with no consequences, and this bill ensures this type of behavior will not be directed toward our children,” said Rep. Barton. “I look forward to the next steps in the legislative process, and I look forward to future proposals to ensure protections of all Americans.”

The “Do Not Track Kids Act of 2011” strengthens privacy protections for children and teens by:

Requiring online companies to explain the types of personal information collected, how that information is used and disclosed, and the policies for collection of personal information;

Requiring online companies to obtain parental consent for collection of children’s personal information;

Prohibiting online companies from using personal information of children and teens for targeted marketing purposes;

Establishing a “Digital Marketing Bill of Rights for Teens” that limits the collection of personal information of teens, including geolocation information of children and teens;

Creating an “Eraser Button” for parents and children by requiring companies to permit users to eliminate publicly available personal information content when technologically feasible.

“We commend Representatives Markey and Barton for listening to the concerns of families and taking action by introducing a ‘Do Not Track Kids’ privacy bill that places kids and teens front and center,” said Jim Steyer, CEO of Common Sense Media. “As it stands now, the nation’s tech privacy policies are outdated, as they do not include protections for mobile and geolocation technologies. Kids and teens are being tracked even more than adults, and marketed to without permission while companies make huge profits off the data – and that is wrong. It is promising to see leaders of both parties come together to address these issues on behalf of children and families, and we hope the bill continues to gain bipartisan support.”

“Today’s teenagers are growing up in a ubiquitous digital media environment, where mobile devices, social networks, virtual reality, interactive games, and online video have become ingrained in their personal and social experience,” said Dr. Kathryn C. Montgomery, Ph.D., Professor, School of Communication American University. “Members of this generation are, in many ways, living their lives online. But while youth have embraced new media, they cannot be expected to understand the subtle, often covert techniques that digital marketers use to track and influence their behaviors. Many teens go online to seek help for their personal problems, to explore their own identities, to find support groups for handling emotional crises in their lives, and sometimes to talk about things they do not feel comfortable or safe discussing with their own parents. Yet, this increased reliance on the Internet subjects them to wholesale data collection and profiling.  By instituting fair information practices for teens now, we can help ensure they are treated with respect in the rapidly growing digital marketplace.”

“Today’s youth and their parents confront a pervasive and unaccountable digital data collection system,” said Jeff Chester, Executive Director, Center for Digital Democracy. “When young people are online, including on mobile phones, playing games, or using social media, they are subject to a wide-range of stealth practices that can threaten their privacy and health. Congressmen Ed Markey and Joe Barton’s Do-Not-Track Kids bill will create much-needed safeguards for both children and adolescents. It will usher in a new Internet era for America’s youth, where their privacy is protected and marketers cannot take unfair advantage of them.”

“In today’s world many children spend as much time on the Internet as they do on the playground,” said Jim Pierce, President, Childhelp. “The Markey-Barton Do Not Track Kids Bill is an important first step in protecting our children from predatory tracking – giving them the freedom to be children not consumers.”

ISPLA notes through its state legislative tracking system that similar legislation was offered in California in February and recent amendments to that state’s bill have now stricken reference to children and made their proposed legislation applicable to all citizens of all ages of

Bruce Hulme, ISPLA Director of Government Affairs

To support the proactive work of ISPLA from State Capitols to the Nation’s Capitol please visit www.ISPLA.org

“Doing more than just keeping the profession informed”

A long-awaited bill has finally been introduced by Rep. Bobby L. Rush [D-IL-1] relating to information brokers and security breaches. The 38-page HR 1707, the "Data Accountability and Trust Act" introduced May 4 pertains to information brokers and is cosponsored by Rep. Joe Barton [R-TX-1] and Rep. Janice D. Schakowsky [D-IL-9]. All three sponsors are members of the House Committee on Energy and Commerce to which this bill has been referred.

Some of the pertinent areas of the bill which ISPLA has concerns are contained in portions of the language which follows:

(b) Special Requirements for Information Brokers-

(1) SUBMISSION OF POLICIES TO THE FTC- The regulations promulgated under subsection (a) shall require each information broker to submit its security policies to the Commission in conjunction with a notification of a breach of security under section 3 or upon request of the Commission.

(2) POST-BREACH AUDIT- For any information broker required to provide notification under section 3, the Commission may conduct audits of the information security practices of such information broker, or require the information broker to conduct independent audits of such practices (by an independent auditor who has not audited such information broker's security practices during the preceding 5 years).

(3) ACCURACY OF AND INDIVIDUAL ACCESS TO PERSONAL INFORMATION-

(A) ACCURACY-

(i) IN GENERAL- Each information broker shall establish reasonable procedures to assure the maximum possible accuracy of the personal information it collects, assembles, or maintains, and any other information it collects, assembles, or maintains that specifically identifies an individual, other than information which merely identifies an individual's name or address.

(ii) LIMITED EXCEPTION FOR FRAUD DATABASES- The requirement in clause (i) shall not prevent the collection or maintenance of information that may be inaccurate with respect to a particular individual when that information is being collected or maintained solely--

(I) for the purpose of indicating whether there may be a discrepancy or irregularity in the personal information that is associated with an individual; and

(II) to help identify, or authenticate the identity of, an individual, or to protect against or investigate fraud or other unlawful conduct.

(B) CONSUMER ACCESS TO INFORMATION-

(i) ACCESS- Each information broker shall--

(I) provide to each individual whose personal information it maintains, at the individual's request at least 1 time per year and at no cost to the individual, and after verifying the identity of such individual, a means for the individual to review any personal information regarding such individual maintained by the information broker and any other information maintained by the information broker that specifically identifies such individual, other than information which merely identifies an individual's name or address; and

(II) place a conspicuous notice on its Internet website (if the information broker maintains such a website) instructing individuals how to request access to the information required to be provided under subclause (I), and, as applicable, how to express a preference with respect to the use of personal information for marketing purposes under clause (iii).

(ii) DISPUTED INFORMATION- Whenever an individual whose information the information broker maintains makes a written request disputing the accuracy of any such information, the information broker, after verifying the identity of the individual making such request and unless there are reasonable grounds to believe such request is frivolous or irrelevant, shall--

(I) correct any inaccuracy; or

(II)(aa) in the case of information that is public record information, inform the individual of the source of the information, and, if reasonably available, where a request for correction may be directed and, if the individual provides proof that the public record has been corrected or that the information broker was reporting the information incorrectly, correct the inaccuracy in the information broker's records; or

(bb) in the case of information that is non-public information, note the information that is disputed, including the individual's statement disputing such information, and take reasonable steps to independently verify such information under the procedures outlined in subparagraph (A) if such information can be independently verified.

(iii) ALTERNATIVE PROCEDURE FOR CERTAIN MARKETING INFORMATION- In accordance with regulations issued under clause (v), an information broker that maintains any information described in clause (i) which is used, shared, or sold by such information broker for marketing purposes, may, in lieu of complying with the access and dispute requirements set forth in clauses (i) and (ii), provide each individual whose information it maintains with a reasonable means of expressing a preference not to have his or her information used for such purposes. If the individual expresses such a preference, the information broker may not use, share, or sell the individual's information for marketing purposes.

(iv) LIMITATIONS- An information broker may limit the access to information required under clause (i)(I) and is not required to provide notice to individuals as required under clause (i)(II) in the following circumstances:

(I) If access of the individual to the information is limited by law or legally recognized privilege.

(II) If the information is used for a legitimate governmental or fraud prevention purpose that would be compromised by such access.

(III) If the information consists of a published media record, unless that record has been included in a report about an individual shared with a third party.

(v) RULEMAKING- Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to carry out this paragraph and to facilitate the purposes of this Act. In addition, the Commission shall issue regulations, as necessary, under section 553 of title 5, United States Code, on the scope of the application of the limitations in clause (iv), including any additional circumstances in which an information broker may limit access to information under such clause that the Commission determines to be appropriate.

(C) FCRA REGULATED PERSONS- Any information broker who is engaged in activities subject to the Fair Credit Reporting Act and who is in compliance with sections 609, 610, and 611 of such Act (15 U.S.C. 1681g; 1681h; 1681i) with respect to information subject to such Act, shall be deemed to be in compliance with this paragraph with respect to such information.

(4) REQUIREMENT OF AUDIT LOG OF ACCESSED AND TRANSMITTED INFORMATION- Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to require information brokers to establish measures which facilitate the auditing or retracing of any internal or external access to, or transmissions of, any data containing personal information collected, assembled, or maintained by such information broker.

(5) PROHIBITION ON PRETEXTING BY INFORMATION BROKERS-

(A) PROHIBITION ON OBTAINING PERSONAL INFORMATION BY FALSE PRETENSES- It shall be unlawful for an information broker to obtain or attempt to obtain, or cause to be disclosed or attempt to cause to be disclosed to any person, personal information or any other information relating to any person by--

(i) making a false, fictitious, or fraudulent statement or representation to any person; or

(ii) providing any document or other information to any person that the information broker knows or should know to be forged, counterfeit, lost, stolen, or fraudulently obtained, or to contain a false, fictitious, or fraudulent statement or representation.

(B) PROHIBITION ON SOLICITATION TO OBTAIN PERSONAL INFORMATION UNDER FALSE PRETENSES- It shall be unlawful for an information broker to request a person to obtain personal information or any other information relating to any other person, if the information broker knew or should have known that the person to whom such a request is made will obtain or attempt to obtain such information in the manner described in subparagraph (A).

(c) Exemption for Certain Service Providers- Nothing in this section shall apply to a service provider for any electronic communication by a third party that is transmitted, routed, or stored in intermediate or transient storage by such service provider.

In this Act, the following definitions apply:

(1) BREACH OF SECURITY- The term `breach of security' means unauthorized access to or acquisition of data in electronic form containing personal information.

(2) COMMISSION- The term `Commission' means the Federal Trade Commission.

(3) DATA IN ELECTRONIC FORM- The term `data in electronic form' means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices.

(4) ENCRYPTION- The term `encryption' means the protection of data in electronic form in storage or in transit using an encryption technology that has been adopted by an established standards setting body which renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data. Such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption.

(5) IDENTITY THEFT- The term `identity theft' means the unauthorized use of another person's personal information for the purpose of engaging in commercial transactions under the name of such other person.

(6) INFORMATION BROKER- The term `information broker'--

(A) means a commercial entity whose business is to collect, assemble, or maintain personal information concerning individuals who are not current or former customers of such entity in order to sell such information or provide access to such information to any nonaffiliated third party in exchange for consideration, whether such collection, assembly, or maintenance of personal information is performed by the information broker directly, or by contract or subcontract with any other entity; and

(B) does not include a commercial entity to the extent that such entity processes information collected by and received from a nonaffiliated third party concerning individuals who are current or former customers or employees of such third party to enable such third party to (1) provide benefits for its employees or (2) directly transact business with its customers.

(7) PERSONAL INFORMATION-

(A) DEFINITION- The term `personal information' means an individual's first name or initial and last name, or address, or phone number, in combination with any 1 or more of the following data elements for that individual:

(i) Social Security number.

(ii) Driver's license number, passport number, military identification number, or other similar number issued on a government document used to verify identity.

(iii) Financial account number, or credit or debit card number, and any required security code, access code, or password that is necessary to permit access to an individual's financial account.

(B) MODIFIED DEFINITION BY RULEMAKING- The Commission may, by rule promulgated under section 553 of title 5, United States Code, modify the definition of `personal information' under subparagraph (A)--

(i) for the purpose of section 2 to the extent that such modification will not unreasonably impede interstate commerce, and will accomplish the purposes of this Act; or

(ii) for the purpose of section 3, to the extent that such modification is necessary to accommodate changes in technology or practices, will not unreasonably impede interstate commerce, and will accomplish the purposes of this Act.

(8) PUBLIC RECORD INFORMATION- The term `public record information' means information about an individual which has been obtained originally from records of a Federal, State, or local government entity that are available for public inspection.

(9) NON-PUBLIC INFORMATION- The term `non-public information' means information about an individual that is of a private nature and neither available to the general public nor obtained from a public record.

(10) SERVICE PROVIDER- The term `service provider' means an entity that provides to a user transmission, routing, intermediate and transient storage, or connections to its system or network, for electronic communications, between or among points specified by such user of material of the user's choosing, without modification to the content of the material as sent or received. Any such entity shall be treated as a service provider under this Act only to the extent that it is engaged in the provision of such transmission, routing, intermediate and transient storage or connections.

Although HR 1707 would preempt state information security laws, there are still avenues for State attorneys general to direct their activity, such as consumer protection laws. ISPLA will be working to insure that the activities of investigators do not fall under the definition of an information broker under the provision in this proposed legislation. ISPLA is carefully reviewing all aspects of this bill and will keep you apprised of further developments and our ongoing lobbying work in Washington, DC.

Bruce Hulme
ISPLA Director of Government Affairs
To join us and support our proactive efforts please visit www.ISPLA.org
We do much more than just keeping the profession informed!

WEBCAMS, SPYWARE & KEYSTROKE MONITORING

A Pennsylvania federal lawsuit filed May 2 and reported in today’s Washington Post claims that Aaron’s Inc., a large furniture rental chain store based out of

Privacy experts contend that Aaron’s has the right to equip its computers with such software to shut off the devices remotely if customers stop paying their bills.  However, customers must be notified of such monitoring. “If I’m renting a computer ... then I have a right to know what the limitations are and I have a right to know if they’re going to be collecting data from my computer,” said Annie Anton, a professor and computer privacy expert with North Carolina State University.

But the couple who sued Aaron’s said they had no knowledge that the computer they rented came equipped with a device that could spy on them. It was not until December 22, 2010 when an Aaron’s manager came to their home to repossess the computer because he mistakenly believed the Byrds had not paid off their “rent-to-own” agreement. However, after they produced a paid receipt the manager showed them a picture of them using the computer that had been taken by the computer’s webcam.

Aaron’s claims it hasn’t authorized any of its corporate stores to install the software described in the lawsuit. Police were contacted by the customer who ascertained the image had been taken by software of Designerware LLC and installed on all Aaron’s rental computers. Designerware is a codefendant in this matter. The Byrds leased their computer from an independently owned and operated franchisee. Aaron’s believes that none of its more than 1,140 company-operated stores had used Designerware’s product or had done any business with it.

It remains to be seen if the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act were violated. If either law was broken then Aaron’s went too far.

Former FTC Commissioner, Peter Swire, an

Fred Cate, an information law professor at

According to the lawsuit, components were soldered into the computer's motherboard or otherwise physically attached to the PC's electronics. It can only be uninstalled and deactivated using a wand.  John Robinson, the plaintiffs’ attorney, indicated the computer is currently held as police evidence. His clients want the federal court to declare their case a class action and are seeking unspecified damages and attorneys' fees. They contend the privacy act allows for a penalty of $10,000 or $100 per day per violation, plus punitive damages and other costs.

PRNewswire released an Aaron's, Inc. item that the lawsuit regarding a violation of privacy relating to a computer rented from an Aaron's franchise store is without merit against Aaron's, Inc.

“The Company believes that none of its over 1,140 Company-operated stores have used the product developed or provided by PC Rental Agent or Designerware LLC, the two vendors named in the lawsuit, and neither vendor is approved or have done any business with Aaron's, Inc.

“Aaron's, Inc. respects its customers' privacy and has not authorized any of its corporate stores to install software that can activate a customer's webcam, capture screenshots, or track keystrokes.  The named plaintiffs leased the computer at issue from an independently owned and operated franchisee.  Aaron's, Inc. intends to vigorously defend itself against these allegations.

Aaron's, Inc. has company-operated and franchised stores in 48 states and

ISPLA expects that this revelation, along with recent coverage of Internet tracking by Google, and several Congressional hearings scheduled for next week, will keep our profession busy during the 112^th Congress.

Bruce Hulme

ISPLA Director of Government Affairs

To join us and support our proactive efforts please visit www.ISPLA.org

We do much more than just keeping the profession informed!

ISPLA Hits the Hill, Harnesses Support, Pursues PAC Activity, and Supports INTELLENET Conference

It was a busy week for executive committee members of ISPLA who walked the halls of Congress, promoted ISPLA-PAC activities at a fundraiser, and joined other members who were attending the 28^th Intellenet Annual Conference. 

Our thanks to our Nicole Bocra, who not only hosted a successful PAC fundraiser at Morton’s Steakhouse in Washington, DC, but also assisted in organizing one of the most successful Intellenet conferences, which was held in Crystal City, Virginia, this past week. Nicole also gave an expert presentation on the use of “Social Media” in conducting investigations. Chairman Peter Psarouthakis presented a well-received talk on Ethics, and Bruce Hulme filled-in for the luncheon speaker who had to cancel at the last minute.

ISPLA board member Jim Olsen, of Texas, Psarouthakis of Michigan, and ISPLA Director of Government Affairs, Hulme, of

Chairman Johnson and Rep. Lloyd Doggett [D-TX-25] then introduced HR 1509, the “Medicare Identity Theft Prevention Act of 2011” to amend Title II of the Social Security Act to prohibit the inclusion of Social Security account numbers on Medicare cards. As we expected, this legislation does not affect our profession. However, should ensuing legislation in this subcommittee be directed towards any restrictions that might affect the use of credit headers, we were assured that ISPLA would be provided an opportunity to give input.

While “hitting Capitol Hill” we also met with staff of Senators John McCain [R-AZ] and John Kerry [D-MA] regarding their Kerry-McCain Bill, S 799, the “Commercial Privacy Bill of Rights Act of 2011.” This bill would apply to any firm that “collects, uses, transfers, or stores covered information concerning more than 5,000 individuals during any consecutive 12-month period.”  Such information includes names or addresses or social security, credit card, or phone numbers or biometric data. The 44-page bill would require the notification of consumers in clear language whenever their data is being collected, and ensure that their information safe from hackers.

Recently, millions of consumers were exposed to the risk of email swindles after a massive security breach by Epsilon, an online marketing firm that handles email marketing lists for hundreds of clients. Companies, including non-profits, that collect information about consumers over the Internet or otherwise, including search engines, telephone companies, and cable companies, will fall under the provisions of this proposed bill. The bill states "The ease of gathering and compiling personal information on the Internet and off, both overtly and surreptitiously, is becoming increasingly efficient and effortless."

Should this bill be enacted, it would require companies to inform consumers the reason that data is being collected, with whom it will be shared, and how it will be safeguarded. The companies would also have to allow consumers to opt out of some data collection, and the consumers must agree, or opt in, to the collection of sensitive data such as medical conditions.

Rep. Cliff Stearns [R-FL-6] has also introduced legislation on the same topic, but not as a companion bill to the above.

ISPLA also met with staff of Representatives Hansen Clarke [D-MI-13] and Pete Sessions [R-TX-32].  They were each recipients of ISPLA-PAC donations in the 111^th Congressional race this past fall. No other political action committee representing our profession made any donations during the 111^th Congress according to FEC filings.  ISPLA’s present proactive legislative agenda included meetings with representatives of the Federal Law Enforcement Officers Association and the Society of Former Special Agents of the Federal Bureau of Investigation regarding several matters of mutual concern.

In 2010, ISPLA partnered with INTELLENET Ltd, an international organization of investigative and security professionals, to handle lobbying and PAC activity.  It was fitting that ISPLA’s executive committee hold its third board meeting in Crystal City,

ISPLA

Investigative & Security Professionals for Legislative Action

Singularly focused on the legislative needs of the Investigative and Security professions

Real Investigators – Real Professionals – Real Representation

www.ISPLA.org

FTC Charges Deceptive Privacy Practices in Google's Rollout of Its Buzz Social Network

Google Agrees to Implement Comprehensive Privacy Program to Protect Consumer Data

March 31, 2011 - Google Inc. has agreed to settle Federal Trade Commission charges that it used deceptive tactics and violated its own privacy promises to consumers when it launched its social network, Google Buzz, in 2010. The agency alleges the practices violate the FTC Act. The proposed settlement bars the company from future privacy misrepresentations, requires it to implement a comprehensive privacy program, and calls for regular, independent privacy audits for the next 20 years. This is the first time an FTC settlement order has required a company to implement a comprehensive privacy program to protect the privacy of consumers’ information. In addition, this is the first time the FTC has alleged violations of the substantive privacy requirements of the U.S.-EU Safe Harbor Framework, which provides a method for U.S. companies to transfer personal data lawfully from the European Union to the United States.

“When companies make privacy pledges, they need to honor them,” said Jon Leibowitz, Chairman of the FTC. “This is a tough settlement that ensures that Google will honor its commitments to consumers and build strong privacy protections into all of its operations."

According to the FTC complaint, Google launched its Buzz social network through its Gmail web-based email product. Although Google led Gmail users to believe that they could choose whether or not they wanted to join the network, the options for declining or leaving the social network were ineffective. For users who joined the Buzz network, the controls for limiting the sharing of their personal information were confusing and difficult to find, the agency alleged.

On the day Buzz was launched, Gmail users got a message announcing the new service and were given two options: “Sweet! Check out Buzz,” and “Nah, go to my inbox.” However, the FTC complaint alleged that some Gmail users who clicked on “Nah...” were nonetheless enrolled in certain features of the Google Buzz social network. For those Gmail users who clicked on “Sweet!,” the FTC alleges that they were not adequately informed that the identity of individuals they emailed most frequently would be made public by default. Google also offered a “Turn Off Buzz” option that did not fully remove the user from the social network.

In response to the Buzz launch, Google received thousands of complaints from consumers who were concerned about public disclosure of their email contacts which included, in some cases, ex-spouses, patients, students, employers, or competitors. According to the FTC complaint, Google made certain changes to the Buzz product in response to those complaints.

When Google launched Buzz, its privacy policy stated that “When you sign up for a particular service that requires registration, we ask you to provide personal information. If we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use.” The FTC complaint charges that Google violated its privacy policies by using information provided for Gmail for another purpose - social networking - without obtaining consumers’ permission in advance.

The agency also alleges that by offering options like “Nah, go to my inbox,” and “Turn Off Buzz,” Google misrepresented that consumers who clicked on these options would not be enrolled in Buzz. In fact, they were enrolled in certain features of Buzz.

The complaint further alleges that a screen that asked consumers enrolling in Buzz, “How do you want to appear to others?” indicated that consumers could exercise control over what personal information would be made public. The FTC charged that Google failed to disclose adequately that consumers’ frequent email contacts would become public by default.

Finally, the agency alleges that Google misrepresented that it was treating personal information from the European Union in accordance with the U.S.-EU Safe Harbor privacy framework. The framework is a voluntary program administered by the U.S. Department of Commerce in consultation with the European Commission. To participate, a company must self-certify annually to the Department of Commerce that it complies with a defined set of privacy principles. The complaint alleges that Google’s assertion that it adhered to the Safe Harbor principles was false because the company failed to give consumers notice and choice before using their information for a purpose different from that for which it was collected.

The proposed settlement bars Google from misrepresenting the privacy or confidentiality of individuals’ information or misrepresenting compliance with the U.S.-E.U Safe Harbor or other privacy, security, or compliance programs. The settlement requires the company to obtain users’ consent before sharing their information with third parties if Google changes its products or services in a way that results in information sharing that is contrary to any privacy promises made when the user’s information was collected. The settlement further requires Google to establish and maintain a comprehensive privacy program, and it requires that for the next 20 years, the company have audits conducted by independent third parties every two years to assess its privacy and data protection practices.

Google’s data practices in connection with its launch of Google Buzz were the subject of a complaint filed with the FTC by the Electronic Privacy Information Center shortly after the service was launched.

The Commission vote to issue the administrative complaint and accept the consent agreement package containing the proposed consent order for public comment was 5-0. Commissioner Rosch concurs with accepting, subject to final approval, the consent order for the purpose of public comment. The reasons for his concurrence are described in a separate Statement.

The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through May 2, 2011, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit written comments electronically or in paper form by following the instructions in the “Invitation To Comment” part of the “Supplementary Information” section. Comments in electronic form should be submitted using the following web link: https://ftcpublic.commentworks.com/ftc/googlebuzz
and following the instructions on the web-based form. Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. The FTC is requesting that any comment filed in paper form near the end of the public comment period be sent by courier or overnight service, if possible, because U.S. postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the respondent has actually violated the law. A consent agreement is for settlement purposes only and does not constitute an admission by the respondent that the law has been violated. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.

“In the past year, The Wall Street Journal's ‘What They Know’ series has revealed that popular websites install thousands of tracking technologies on people's computers without their knowledge, feeding an industry that gathers and sells information on their finances, political leanings and religious interests, among other things.” – March 16, 2011 WSJ

On March 16, 2011, the Senate Committee on Commerce, Science, and Transportation heard testimony from its chairman Sen. Jay Rockefeller [D-WV] and witnesses from the Federal Trade Commission, Department of Commerce, Microsoft, GroupM Interaction, an independent researcher, Intuit, and the ACLU.  

Testimony is available on line at the Commerce Committee’s website. The ACLU paper “The State of Online Consumer Privacy” is an excellent reference source for privacy issues material, especially the links identified in its footnotes. Over the years a number of ISPLA members, as well as I, have relied on much of the same material when meeting with legislators, privacy advocates, and business leaders or preparing testimony on issues affecting investigative and security professionals.

The subject of consumer privacy relative to the Internet is one being closely monitored by ISPLA. However, this issue presently does not warrant excessive involvement of lobbying resources at the present time by our members. But the issue does bear watching.  The major players from all perspectives have far greater resources than our profession. What we must make certain is that the recommendations evolving from hearings such as this, as well as other pending legislation in the House and Senate do not expand beyond Internet tracking. ISPLA has previously reported on separate legislation offered by Rep. Bobby Rush [D-IL-1], Rep. Cliff Stearns [R-FL-6], Sen. John McCain [R-AZ] and Sen. John Kerry [D-MA], as well as proposed “Do Not Track” regulations by the FTC. Most of the Senate Commerce Committee excerpts below were prepared by the Democrat members of the committee.     

Key Quotations from the Hearing:

“Now, I appreciate that we live in a world in which online technology is rapidly evolving. I know some online companies have taken steps to address consumer privacy. And, I appreciate the need to proceed carefully when providing consumer protections that may disrupt the functionality of the Internet. But Congress can no longer sit on the sidelines. There is an online privacy war going on, and without help, consumers will lose. We must act to give Americans the basic online privacy protections they deserve.” - Chairman John D. (Jay) Rockefeller IV

“In light of the concerns expressed about online tracking, the [Preliminary FTC] Staff Report recommended a Do Not Track mechanism. A robust, effective Do Not Track system would ensure that consumers can opt out once, rather than having to exercise choices on a company-by-company or transaction-by-transaction basis. Such a universal mechanism could be accomplished through legislation or potentially through robust, enforceable self-regulation.” -  Jon D. Leibowitz, Chairman, Federal Trade Commission

“Having carefully reviewed all stakeholder comments to the Green Paper, the Department has concluded that the U.S. consumer data privacy framework will benefit from legislation to establish a clearer set of rules for the road for businesses and consumers, while preserving the innovation and free flow of information that are hallmarks of the Internet.” - Lawrence E. Strickling, Assistant Secretary of Commerce for Communications and Information, National Telecommunications and Information Administration, U.S. Department of Commerce 

“In the digital era, privacy is no longer about being ‘let alone.’ Privacy is about knowing what data is being collected and what is happening to it, having choices about how it is collected and used, and being confident that it is secure.” - Erich D. Andersen, Vice President and Deputy General Counsel, Microsoft Corporation 

“We want to build consumer trust in the online experience, and therefore we believe that consumers should be able to choose whether and how their data is collected or used for online behavioral advertising. Our clients also want to provide these choices to maintain the confidence of their customers. Global companies work hard every day to protect their brands, and they recognize that their customers may have different preferences about online advertising.”  - John Montgomery, Chief Operating Officer, GroupM Interaction

“Consumers need more transparency into who is tracking them online, what data is being collected, and how this data is being used, shared or sold. Today’s technical defenses to online tracking are not able to stop the leading tracking technologies, and consumers often do not have meaningful ways to control them. To be effective, privacy protections for consumers online will likely require both a technical and policy component, working in tandem, and I believe these discussions here today are a great step in making that union a reality.”  - Ashkan Soltani, Researcher and Consultant 

“As we enter this important discussion, it is necessary to further emphasize the importance of both respect for the consumer participation and control of information and the value and benefit of continued innovation, in particular where the future of economic growth is goingundefineddata driven innovation. The key to our success and to ensuring balance among these interests is earning the customers trust.” - Barbara Lawler, Chief Privacy Officer, Intuit, Inc.

“If this collection of data is allowed to continue unchecked, then capitalism will build what the government never couldundefineda complete surveillance state online. Without government intervention, we may soon find the internet has been transformed from a library and playground to a fishbowl, and that we have unwittingly ceded core values of privacy and autonomy.” -  Chris Calabrese, Legislative Counsel, American Civil Liberties

The Fair Information Practice Principles (FIPPs), written over thirty years ago, in the view of the ACLU has become the basis for comprehensive privacy laws in most of the industrialized world as well as sector specific privacy laws in the United States. In 2008 the Privacy Office of the Department of Homeland Security formally adopted them in its analysis of DHS programs. And in a recent report, the Department of Commerce recommended that the FIPPs as described by DHS be adopted as the basis for internet regulation. The FIPPs stand for eight relatively straightforward ideas:

• Transparency: Individuals should have clear notice about the data collection practices involving them.
• Individual Participation: Individuals should have the right to consent to the use of their information.
• Purpose Specification: Data collectors should describe why they need particular information.
• Data Minimization: Information should only be collected if it‘s needed.
• Use Limitation: Information collected for one purpose shouldn‘t be used for another.
• Data Quality and Integrity: Information should be accurate.
• Security: Information should be kept secure.
• Accountability and Auditing: Data collectors should know who has accessed information and how it is used.

While some adjustments will have to be made to conform to new technologies, international internet data collection practices, as well as the data collection practices of other sectors of the

The ACLU written testimony indicates that the rapid adoption of new testimony has not eliminated Americans’ expectations of privacy. They reference a 2009 study by Joseph Turow, et al, which indicates that 69% of Internet users want the legal right to know everything that a Web site knows about them and 92% want the right to require websites to delete information about them.

Consumers also oppose Internet tracking according to a 2010 study by Lymari Morale which indicates that 67% reject the idea that advertisers should be able to match ads based on specific websites consumers visit, and 61% believe these practices were not justified even if they kept costs down and allowed consumers to visit websites for free. Thus, Americans, although making great use of the Internet are still very concerned over their privacy and troubled by the practice of behavioral targeting.  They expect their online activities will remain private, hence the ongoing efforts by Congress and regulators to propose solutions to protect consumers’ Internet privacy.

In closing, the recent Wall Street Journal article states:

“The administration's plan to push for legislation reflects a shifting attitude by the government, which for more than a decade favored a hands-off approach to the Internet. Officials have said the increasing intrusiveness of online tracking has forced them to reassess that approach.”

ISPLA’s mission is help contain such government regulatory efforts to just Internet activities and make certain such legislation does not expand to data collected or disseminated by investigators.    

Bruce Hulme

ISPLA Director of Government Affairs

Investigative & Security Professionals for Legislative Action

www.ISPLA.org

"Real Investigators, Real Professionals, Real Representation"